Summary
Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages
Workarounds
Only Fides deployments which have been configured to use html as the package format in the storage destination are vulnerable. Using json or csv instead eliminates this vulnerability.
Impact
The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine.
It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the file:// protocol.
Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2023-47114 has a CVSS score of 4.3 (Medium). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.23.3); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The vulnerability has been patched in Fides version TBC. Users are advised to upgrade to this version or later to secure their systems against this threat.
Frequently Asked Questions
- What is CVE-2023-47114? CVE-2023-47114 is a medium-severity cross-site scripting (XSS) vulnerability in ethyca-fides (pip), affecting versions >= 2.15.1, < 2.23.3. It is fixed in 2.23.3. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2023-47114? CVE-2023-47114 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of ethyca-fides are affected by CVE-2023-47114? ethyca-fides (pip) versions >= 2.15.1, < 2.23.3 is affected.
- Is there a fix for CVE-2023-47114? Yes. CVE-2023-47114 is fixed in 2.23.3. Upgrade to this version or later.
- Is CVE-2023-47114 exploitable, and should I be worried? Whether CVE-2023-47114 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2023-47114 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2023-47114? Upgrade
ethyca-fidesto 2.23.3 or later.