CVE-2024-31223: Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
SERVER_SIDE_FIDES_API_URL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port.
This vulnerability allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL.
References
- github.com/advisories/GHSA-53q7-4874-24qg
- github.com/ethyca/fides
- github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
- github.com/ethyca/fides/commit/cd510216b281de5443ec1c126add95cc5be0970a
- github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg
- nvd.nist.gov/vuln/detail/CVE-2024-31223
Code Behaviors & Features
Detect and mitigate CVE-2024-31223 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →