CVE-2024-45053

Advisory

In ethyca-fides affected versions, the Email Templating feature implements Jinja2 without adequate input sanitization or rendering environment restrictions. This oversight creates a vulnerability to Server-Side Template Injection, potentially allowing Remote Code Execution by privileged users. In this context, a privileged user is defined as an Admin UI user with either the default 'Owner' or 'Contributor' role. Such users can exploit this vulnerability to escalate their access and execute arbitrary code on the underlying Fides Webserver container where the Jinja template rendering function operates.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ethyca/fides/commit/829cbd9cb5ef9c814fbac1ed6800e8d939d359c5
• https://github.com/advisories/GHSA-c34r-238x-f7qx
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45053