Summary
Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints
The Fides webserver has a number of endpoints that retrieve ConnectionConfiguration records and their associated secrets which can contain sensitive data (e.g. passwords, private keys, etc.). These secrets are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising.
Fides's developers have available to them a Pydantic field-attribute (sensitive) that they can annotate as True to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses sensitive annotations to mask the sensitive fields with a "**********" placeholder value.
This vulnerability is due to a bug in that function, which prevented sensitive API model fields that were nested below the root-level of a secrets object from being masked appropriately. Only the BigQuery connection configuration secrets meets these criteria: the secrets schema has a nested sensitive keyfile_creds.private_key property that is exposed in plaintext via the APIs.
Connection types other than BigQuery with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability.
Workarounds
There are no workarounds.
Proof of concept
Multiple endpoints are impacted, but this PoC will use GET /api/v1/system/{system_key} as an example.
- Using the Admin UI, navigate to
/add-systems. Add and save a new systembq_poc. - In the integrations tab of the new system, configure and save a BigQuery integration with secrets.
- Log in as a different user with any role except Approver and navigate to the
/systemspage. - Open the network section of your browser's developer tools.
- Click on the
bq_pocsystem's meatball menu and then click edit. - In the network section of browser dev tools you will observe a HTTP GET http://localhost:8080/api/v1/system/bq_poc/ request. In the body of the JSON response the integration secrets values entered in Step 2 are exposed in plaintext i.e.
{
"secrets": {
"keyfile_creds": {
"type": "value",
"project_id": "value",
"private_key_id": "value",
"private_key": "value",
"client_email": "value",
"client_id": "value",
"auth_uri": "value",
"token_uri": "value",
"auth_provider_x509_cert_url": "value",
"client_x509_cert_url": "value"
}
}
}
Impact
The Google Cloud secrets used for a Fides BigQuery integration may be retrieved in plaintext by any authenticated Admin UI user, except those with the Approver role. Any API users authorized to access the following endpoints may also retrieve the key in plaintext.
Endpoints impacted:
GET /api/v1/connectionsPATCH /api/v1/connectionsGET /api/v1/connection/{connection_key}PATCH /api/v1/system/{system_key}/connectionGET /api/v1/system/{system_key}GET /api/v1/system/{system_key}/connection
Connection config secret schemas impacted:
BigQuerySchema
CVE-2024-35189 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.37.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments: https://cloud.google.com/iam/docs/key-rotation
Frequently Asked Questions
- What is CVE-2024-35189? CVE-2024-35189 is a medium-severity security vulnerability in ethyca-fides (pip), affecting versions < 2.37.0. It is fixed in 2.37.0.
- How severe is CVE-2024-35189? CVE-2024-35189 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of ethyca-fides are affected by CVE-2024-35189? ethyca-fides (pip) versions < 2.37.0 is affected.
- Is there a fix for CVE-2024-35189? Yes. CVE-2024-35189 is fixed in 2.37.0. Upgrade to this version or later.
- Is CVE-2024-35189 exploitable, and should I be worried? Whether CVE-2024-35189 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2024-35189 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2024-35189? Upgrade
ethyca-fidesto 2.37.0 or later.