CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload
A malicious user can exploit a Server-Side Request Forgery vulnerability in Fides to access internal systems and exfiltrate data via crafted YAML files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46124?
CVE-2023-46124 is a high-severity server-side request forgery vulnerability in ethyca fides, published on 24 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.
Weakness: CWE-918
Which versions are affected by CVE-2023-46124?
3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ethyca-fides PyPI | All versions | 2.22.1 |
ethyca-fides PyPI | All versions | 2.22.1 |
ethyca-fides PyPI | All versions | 2.22.1 |
Products include Ethyca Fides.
How do I fix CVE-2023-46124?
Upgrade ethyca-fides to 2.22.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-46124 being exploited?
There is no known exploitation of CVE-2023-46124 in the wild and no public exploit code.
Other vulnerabilities in ethyca fides
- CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-36827 Fides vulnerable to Path Traversal in Webserver API
Sources
Also known as GHSA-jq3w-9mgf-43m4, PYSEC-2026-1344.