ExploitCVE-2024-34715
Improper Encoding or Escaping of Output (CWE-116)
Summary
The Fides webserver improperly escapes special characters like @ and $ in the password used to connect to the hosted PostgreSQL database. This can lead to a partial exposure of the database password in the webserver error logs if the password contains those special characters.
Impact
An attacker who gains access to the webserver error logs can view portions of the database password. This could potentially allow them to brute force the full password and gain unauthorized access to the database containing sensitive application data.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available in Fides version 2.37.0 that properly escapes special characters in the database password.
Mitigation
Users are advised to upgrade to Fides version 2.37.0 or later to remediate this vulnerability. There are no known workarounds.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Timeline
A CVSS base score of 2.3 has been assigned.
Feedly found the first article mentioning CVE-2024-34715. See article
NVD published the first details for CVE-2024-34715
This CVE started to trend in security discussions
EPSS Score was set to: 0.05% (Percentile: 15.1%)
This CVE stopped trending in security discussions