CVE-2023-36827 Fides vulnerable to Path Traversal in Webserver API
Remote attackers can access arbitrary files on the Fides webserver container filesystem via path traversal in the API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36827?
CVE-2023-36827 is a high-severity path traversal vulnerability in ethyca fides, published on 5 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal (directory traversal) vulnerability affects fides versions lower than version `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. The vulnerability is patched in fides `2.15.1`.
If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error. Additionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2023-36827?
3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ethyca-fides PyPI | All versions | 2.15.1 |
ethyca-fides PyPI | All versions | 2.15.1 |
ethyca-fides PyPI | All versions | 2.15.1 |
Products include Ethyca Fides.
How do I fix CVE-2023-36827?
Upgrade ethyca-fides to 2.15.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-36827 being exploited?
There is no known exploitation of CVE-2023-36827 in the wild and no public exploit code.
Other vulnerabilities in ethyca fides
- CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload
Sources
Also known as GHSA-r25m-cr6v-p9hq, PYSEC-2023-107.