CVE-2024-31223: Ethyca Fides Information Disclosure Flaw

CVE-2024-31223 Overview

CVE-2024-31223 is an information disclosure vulnerability in Ethyca Fides, an open-source privacy engineering platform. The SERVER_SIDE_FIDES_API_URL environment variable configures how the Fides Privacy Center communicates with the Fides webserver backend. This URL typically contains sensitive infrastructure details including private IP addresses, internal domain names, and non-public ports. An unauthenticated attacker can issue an HTTP GET request to the Privacy Center that returns this server-side URL. The flaw affects Fides versions 2.19.0 through releases prior to 2.39.2rc0. The exposure aids reconnaissance by revealing internal network topology and backend service locations [CWE-497].

Critical Impact
Unauthenticated remote attackers can retrieve server-side configuration data exposing private IP addresses, internal domain names, and backend ports used by the Fides Privacy Center.

Affected Products

Ethyca Fides versions 2.19.0 and later
Ethyca Fides versions prior to 2.39.2rc0
Fides Privacy Center component

Discovery Timeline

2024-07-03 - CVE-2024-31223 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31223

Vulnerability Analysis

The Fides Privacy Center exposes the value of SERVER_SIDE_FIDES_API_URL through an HTTP GET request that requires no authentication. This variable is intended to remain internal to the server-side runtime and is used by the Privacy Center to reach the Fides webserver backend. Because the Privacy Center inlined this configuration into client-accessible data, remote requesters could retrieve details about the backend infrastructure. The disclosed URL commonly contains private IP addresses, internal DNS names, and non-standard ports.

Attackers can use the exposed URL to map internal architecture, identify pivot targets, and design follow-on attacks such as Server-Side Request Forgery (SSRF) or direct probing of internal services. The vulnerability does not affect data integrity or availability directly, but it lowers the reconnaissance barrier for network-adjacent attacks.

Root Cause

The root cause is exposure of sensitive system information to unauthorized actors [CWE-497]. Server-side configuration values intended to remain on the backend were passed into client-reachable contexts. The patch removes the serverSideFidesApiUrl value from client-side experience configuration objects generated by the Privacy Center.

Attack Vector

Exploitation requires only network reachability to the Fides Privacy Center. An unauthenticated attacker issues an HTTP GET request against the Privacy Center endpoint that returns experience configuration. The response contains the serverSideFidesApiUrl value, disclosing the backend URL.

typescript

// Patch removing serverSideFidesApiUrl from client-side config
// File: clients/admin-ui/src/features/privacy-experience/preview/helpers.ts
     fidesApiUrl: "http://localhost:8080/api/v1",
     preventDismissal: experienceConfig.dismissable ?? false,
     allowHTMLDescription: true,
-    serverSideFidesApiUrl: "",
     fidesString: null,
     fidesJsBaseUrl: "",
     base64Cookie: false,

// File: clients/fides-js/src/fides-tcf.ts
     modalLinkId: null,
     privacyCenterUrl: "",
     fidesApiUrl: "",
-    serverSideFidesApiUrl: "",
     tcfEnabled: true,
     gppEnabled: false,
     fidesEmbed: false,
// Source: https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097

The patch removes the field from configuration objects returned to clients, preventing server-side URL disclosure.

Detection Methods for CVE-2024-31223

Indicators of Compromise

Unauthenticated HTTP GET requests to Fides Privacy Center configuration endpoints originating from unexpected external sources.
HTTP responses from the Privacy Center containing a serverSideFidesApiUrl field with a non-empty value.
Follow-on probing traffic to private IP ranges or internal hostnames matching values disclosed by the Privacy Center.

Detection Strategies

Inspect Privacy Center responses at a reverse proxy or WAF for the presence of the serverSideFidesApiUrl string in JSON payloads.
Correlate Fides access logs with subsequent outbound scans targeting the disclosed backend host and port.
Review deployed Fides versions across the estate and flag any instance between 2.19.0 and versions prior to 2.39.2rc0.

Monitoring Recommendations

Enable verbose access logging on the Privacy Center and forward logs to a centralized analytics platform.
Alert on repeated unauthenticated requests to experience configuration endpoints from a single source.
Monitor for lateral movement attempts to internal hostnames that match previously disclosed backend URLs.

How to Mitigate CVE-2024-31223

Immediate Actions Required

Upgrade Fides to version 2.39.2rc0 or later without delay.
Inventory all Fides deployments and identify any instance running versions 2.19.0 through releases prior to 2.39.2rc0.
Rotate or re-scope internal hostnames and ports if the SERVER_SIDE_FIDES_API_URL value has been exposed publicly.
Review reverse proxy and CDN logs for prior requests that may have leaked the configuration value.

Patch Information

Ethyca released the fix in Fides 2.39.2rc0. The patch removes the serverSideFidesApiUrl property from client-accessible configuration objects. Full details are available in the GitHub Security Advisory GHSA-53q7-4874-24qg and the remediation commit.

Workarounds

No official workarounds exist according to the vendor advisory; upgrading is the only supported remediation.
As a defense-in-depth measure, restrict Privacy Center exposure to trusted networks until the patch is applied.
Place the Privacy Center behind a WAF rule that strips or blocks responses containing the serverSideFidesApiUrl field for unauthenticated requests.

bash

# Verify installed Fides version and upgrade
pip show fides | grep -i version
pip install --upgrade "fides>=2.39.2rc0"

# Container-based deployments
docker pull ethyca/fides:2.39.2
docker-compose down && docker-compose up -d