The Fides webserver has a number of endpoints that retrieve ConnectionConfiguration
records and their associated secrets
which can contain sensitive data (e.g. passwords, private keys, etc.). These secrets
are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising.
Fides's developers have available to them a Pydantic field-attribute (sensitive
) that they can annotate as True
to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses sensitive
annotations to mask the sensitive fields with a "**********"
placeholder value.
This vulnerability is due to a bug in that function, which prevented sensitive
API model fields that were nested below the root-level of a secrets
object from being masked appropriately. Only the BigQuery
connection configuration secrets meets these criteria: the secrets schema has a nested sensitive keyfile_creds.private_key
property that is exposed in plaintext via the APIs.
Connection types other than BigQuery
with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability.
The Google Cloud secrets used for a Fides BigQuery integration may be retrieved in plaintext by any authenticated Admin UI user, except those with the Approver role. Any API users authorized to access the following endpoints may also retrieve the key in plaintext.
Endpoints impacted:
- GET /api/v1/connections
- PATCH /api/v1/connections
- GET /api/v1/connection/{connection_key}
- PATCH /api/v1/system/{system_key}/connection
- GET /api/v1/system/{system_key}
- GET /api/v1/system/{system_key}/connection
Connection config secret schemas impacted:
- BigQuerySchema
The vulnerability has been patched in Fides version 2.37.0
. Users are advised to upgrade to this version or later to secure their systems against this threat.
Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments: https://cloud.google.com/iam/docs/key-rotation
There are no workarounds.
Multiple endpoints are impacted, but this PoC will use GET /api/v1/system/{system_key}
as an example.
/add-systems
. Add and save a new system bq_poc
./systems
page.bq_poc
system's meatball menu and then click edit.{
"secrets": {
"keyfile_creds": {
"type": "value",
"project_id": "value",
"private_key_id": "value",
"private_key": "value",
"client_email": "value",
"client_id": "value",
"auth_uri": "value",
"token_uri": "value",
"auth_provider_x509_cert_url": "value",
"client_x509_cert_url": "value"
}
}
}
{ "nvd_published_at": "2024-05-30T20:15:09Z", "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-06-02T22:28:03Z" }