Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
Summary
CVE-2023-46124: Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload. Affects ethyca-fides versions < 2.22.1. Fixed in 2.22.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Fides is a web application that allows users to upload custom integrations as ZIP files containing configuration and dataset definitions in YAML format. These integrations are used to connect Fides with other systems and services. The application does not properly validate requests made by these integrations, which can lead to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability allows a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment. However, exploitation is limited to API clients with the CONNECTOR_TEMPLATE_REGISTER authorization scope, which is restricted to highly privileged users in the Fides Admin UI.
Vulnerability Detail
The Fides web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. This vulnerability arises from the lack of proper validation of requests made by custom integrations. Specially crafted YAML dataset and config files can be used to perform arbitrary requests to internal systems, including localhost, and exfiltrate data outside the environment. The impact of this vulnerability can be significant, as it allows an attacker to access sensitive information and potentially compromise the integrity and confidentiality of the system.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.22.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.22.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to the patched version of Fides to mitigate the risk.
Conclusion
The Fides Server-Side Request Forgery vulnerability in the custom integration upload feature can allow an attacker to perform unauthorized requests to internal systems and potentially exfiltrate sensitive data. Users are strongly advised to upgrade to Fides version 2.22.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ethyca-fides →
FAQ
Fides is a web application that allows users to upload custom integrations as ZIP files containing configuration and dataset definitions in YAML format. These integrations are used to connect Fides with other systems and services.
A Server-Side Request Forgery (SSRF) vulnerability is a type of security vulnerability that allows an attacker to make arbitrary requests to internal systems from a vulnerable application. In the case of Fides, this vulnerability allows an attacker to perform unauthorized requests to internal systems and potentially exfiltrate data outside the environment.
The vulnerability affects users of Fides who have custom integrations uploaded as ZIP files. Exploitation of this vulnerability requires API clients with the CONNECTOR_TEMPLATE_REGISTER authorization scope, which is typically limited to highly privileged users in the Fides Admin UI.
The impact of this vulnerability can be significant. An attacker can use the SSRF vulnerability to access internal systems, including localhost, and potentially exfiltrate sensitive data. This can lead to unauthorized access, data breaches, and compromise of the system's integrity and confidentiality.
To mitigate the risk, it is crucial to upgrade to Fides version 2.22.1 or later. This version includes the necessary patches to address the SSRF vulnerability. Users should update their Fides installation as soon as possible to ensure the security of their systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
