ghsa-rcvg-jj3g-rj7c
Vulnerability from github
Published
2024-06-02 22:28
Modified
2024-06-02 22:28
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints
Details

The Fides webserver has a number of endpoints that retrieve ConnectionConfiguration records and their associated secrets which can contain sensitive data (e.g. passwords, private keys, etc.). These secrets are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising.

Fides's developers have available to them a Pydantic field-attribute (sensitive) that they can annotate as True to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses sensitive annotations to mask the sensitive fields with a "**********" placeholder value.

This vulnerability is due to a bug in that function, which prevented sensitive API model fields that were nested below the root-level of a secrets object from being masked appropriately. Only the BigQuery connection configuration secrets meets these criteria: the secrets schema has a nested sensitive keyfile_creds.private_key property that is exposed in plaintext via the APIs.

Connection types other than BigQuery with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability.

Impact

The Google Cloud secrets used for a Fides BigQuery integration may be retrieved in plaintext by any authenticated Admin UI user, except those with the Approver role. Any API users authorized to access the following endpoints may also retrieve the key in plaintext.

Endpoints impacted: - GET /api/v1/connections - PATCH /api/v1/connections - GET /api/v1/connection/{connection_key} - PATCH /api/v1/system/{system_key}/connection - GET /api/v1/system/{system_key} - GET /api/v1/system/{system_key}/connection

Connection config secret schemas impacted: - BigQuerySchema

Patches

The vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments: https://cloud.google.com/iam/docs/key-rotation

Workarounds

There are no workarounds.

Proof of concept

Multiple endpoints are impacted, but this PoC will use GET /api/v1/system/{system_key} as an example.

  1. Using the Admin UI, navigate to /add-systems. Add and save a new system bq_poc.
  2. In the integrations tab of the new system, configure and save a BigQuery integration with secrets.
  3. Log in as a different user with any role except Approver and navigate to the /systems page.
  4. Open the network section of your browser's developer tools.
  5. Click on the bq_poc system's meatball menu and then click edit.
  6. In the network section of browser dev tools you will observe a HTTP GET http://localhost:8080/api/v1/system/bq_poc/ request. In the body of the JSON response the integration secrets values entered in Step 2 are exposed in plaintext i.e.

json { "secrets": { "keyfile_creds": { "type": "value", "project_id": "value", "private_key_id": "value", "private_key": "value", "client_email": "value", "client_id": "value", "auth_uri": "value", "token_uri": "value", "auth_provider_x509_cert_url": "value", "client_x509_cert_url": "value" } } }

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ethyca-fides"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.37.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35189"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-02T22:28:03Z",
    "nvd_published_at": "2024-05-30T20:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. \n\nFides\u0027s developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `\"**********\"` placeholder value.\n\nThis vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs.\n\nConnection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability.\n\n\n### Impact\n\nThe Google Cloud secrets used for a Fides BigQuery integration may be retrieved in plaintext by any authenticated Admin UI user, except those with the Approver role. Any API users authorized to access the following endpoints may also retrieve the key in plaintext.\n\nEndpoints impacted:\n- `GET /api/v1/connections`\n- `PATCH /api/v1/connections`\n- `GET /api/v1/connection/{connection_key}`\n- `PATCH /api/v1/system/{system_key}/connection`\n- `GET /api/v1/system/{system_key}`\n- `GET /api/v1/system/{system_key}/connection`\n\nConnection config secret schemas impacted:\n- `BigQuerySchema`\n\n### Patches\nThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\nUsers are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments: https://cloud.google.com/iam/docs/key-rotation\n\n### Workarounds\nThere are no workarounds.\n\n### Proof of concept\n\nMultiple endpoints are impacted, but this PoC will use `GET /api/v1/system/{system_key}` as an example.\n\n1. Using the Admin UI, navigate to `/add-systems`. Add and save a new system `bq_poc`.\n2. In the integrations tab of the new system, configure and save a BigQuery integration with secrets.\n3. Log in as a different user with any role except Approver and navigate to the `/systems` page.\n4. Open the network section of your browser\u0027s developer tools.\n5. Click on the `bq_poc` system\u0027s meatball menu and then click edit.\n6. In the network section of browser dev tools you will observe a HTTP GET http://localhost:8080/api/v1/system/bq_poc/ request. In the body of the JSON response the integration secrets values entered in Step 2 are exposed in plaintext i.e.\n\n```json\n{\n  \"secrets\": {\n    \"keyfile_creds\": {\n      \"type\": \"value\",\n      \"project_id\": \"value\",\n      \"private_key_id\": \"value\",\n      \"private_key\": \"value\",\n      \"client_email\": \"value\",\n      \"client_id\": \"value\",\n      \"auth_uri\": \"value\",\n      \"token_uri\": \"value\",\n      \"auth_provider_x509_cert_url\": \"value\",\n      \"client_x509_cert_url\": \"value\"\n    }\n  }\n}\n```",
  "id": "GHSA-rcvg-jj3g-rj7c",
  "modified": "2024-06-02T22:28:03Z",
  "published": "2024-06-02T22:28:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35189"
    },
    {
      "type": "WEB",
      "url": "https://cloud.google.com/iam/docs/key-rotation"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ethyca/fides"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.