Vulnerability · Published Sep 4, 2024 · Assigned by GitHub_M
CVE-2024-45053Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
Critical 9.1
In plain English
A critical-severity security flaw in fides from ethyca. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default `Owner` or `Contributor` role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | ethyca-fides | 2.44.0 | GHSA-c34r-238x-f7qx |
| PyPI | ethyca-fides | 2.44.0 | PYSEC-2026-1338 |
Affected products (as reported)
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H