CVE-2023-46124

CVE-2023-46124 is a Server-Side Request Forgery (SSRF) vulnerability affecting Fides, an open-source privacy engineering platform. Malicious actors can upload specially crafted YAML configuration or dataset files to the Fides web application, enabling them to make arbitrary requests to internal systems and exfiltrate data. This vulnerability stems from insufficient validation of connections to internal resources. With a CVSS score of 7.2 (High), this vulnerability allows an unauthenticated attacker to achieve high impact on confidentiality, integrity, and availability with low attack complexity. The attacker can exploit this remotely over the network. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. The vulnerability has been patched in Fides version 2.22.1.