Insertion of Sensitive Information into Log File Affecting ethyca-fides package, versions [,2.37.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ETHYCAFIDES-7164638
- published 30 May 2024
- disclosed 29 May 2024
- credit Tariq Yusuf
Introduced: 29 May 2024
CVE-2024-34715 Open this link in a new tabHow to fix?
Upgrade ethyca-fides to version 2.37.0 or higher.
Overview
ethyca-fides is an Open-source ecosystem for data privacy as code.
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged.
PoC
Create a hosted PostgreSQL database for Fides with a password including
@or$e.g.p@sswordRun Fides and observe failure, sample log attached
fides | 2024-02-28 14:27:52.609 | ERROR | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name "ssword@fides-db" to address: Name or service not known