VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Jul 3, 2024· Updated Aug 2, 2024

Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

CVE-2024-31223

Description

Fides is an open-source privacy engineering platform, and SERVER_SIDE_FIDES_API_URL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ethyca-fidesPyPI
>= 2.19.0, < 2.39.22.39.2

Affected products

1

Patches

2
0555080541f1

Merge pull request from GHSA-53q7-4874-24qg

https://github.com/ethyca/fidesLucano VeraJul 3, 2024via ghsa
commit
8 files changed · +36 −16
  • CHANGELOG.md+4 −0 modified
    @@ -31,6 +31,10 @@ The types of changes are:
 ### Security
 - Removed FidesJS's exposure to `polyfill.io` supply chain attack [CVE-2024-38537](https://github.com/ethyca/fides/security/advisories/GHSA-cvw4-c69g-7v7m)
 
+### Security
+- Remove the SERVER_SIDE_FIDES_API_URL env variable from the client clientSettings [CVE-2024-31223](https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg)
+
+
 ## [2.39.0](https://github.com/ethyca/fides/compare/2.38.1...2.39.0)
 
 ### Added
  • clients/admin-ui/src/features/privacy-experience/preview/helpers.ts+0 −1 modified
    @@ -47,7 +47,6 @@ export const buildBaseConfig = (
     fidesApiUrl: "http://localhost:8080/api/v1",
     preventDismissal: experienceConfig.dismissable ?? false,
     allowHTMLDescription: true,
-    serverSideFidesApiUrl: "",
     fidesString: null,
     fidesJsBaseUrl: "",
     base64Cookie: false,
  • clients/fides-js/src/fides-tcf.ts+0 −1 modified
    @@ -245,7 +245,6 @@ const _Fides: FidesGlobal = {
     modalLinkId: null,
     privacyCenterUrl: "",
     fidesApiUrl: "",
-    serverSideFidesApiUrl: "",
     tcfEnabled: true,
     gppEnabled: false,
     fidesEmbed: false,
  • clients/fides-js/src/fides.ts+0 −1 modified
    @@ -183,7 +183,6 @@ const _Fides: FidesGlobal = {
     modalLinkId: null,
     privacyCenterUrl: "",
     fidesApiUrl: "",
-    serverSideFidesApiUrl: "",
     tcfEnabled: false,
     gppEnabled: false,
     fidesEmbed: false,
  • clients/fides-js/src/lib/consent-types.ts+0 −3 modified
    @@ -72,9 +72,6 @@ export interface FidesInitOptions {
   // URL for the Fides API, used to fetch and save consent preferences. Required.
   fidesApiUrl: string;
 
-  // URL for Server-side Fides API, used to fetch geolocation and consent preference. Optional.
-  serverSideFidesApiUrl: string;
-
   // Whether we should show the TCF modal
   tcfEnabled: boolean;
  • clients/privacy-center/app/server-environment.ts+21 −4 modified
    @@ -26,9 +26,15 @@ import {
 } from "~/types/config";
 
 /**
- * SERVER-SIDE functions
+ * Subset of PrivacyCenterSettings that are for use only on server-side and
+ * should never be exposed to the client.
  */
 
+export type PrivacyCenterServerSettings = Pick<
+  PrivacyCenterSettings,
+  "SERVER_SIDE_FIDES_API_URL"
+>;
+
 /**
  * Subset of PrivacyCenterSettings that are forwarded to the client.
  *
@@ -37,7 +43,6 @@ import {
 export type PrivacyCenterClientSettings = Pick<
   PrivacyCenterSettings,
   | "FIDES_API_URL"
-  | "SERVER_SIDE_FIDES_API_URL"
   | "DEBUG"
   | "GEOLOCATION_API_URL"
   | "IS_GEOLOCATION_ENABLED"
@@ -261,6 +266,20 @@ export const loadStylesFromFile = async (
   return file;
 };
 
+/**
+ * Load server settings from global environment variables
+ * The returned Server settings should never be exposed to the client
+ */
+export const loadServerSettings = (): PrivacyCenterServerSettings => {
+  const settings = loadEnvironmentVariables();
+  const serverSideSettings: PrivacyCenterServerSettings = {
+    SERVER_SIDE_FIDES_API_URL:
+      settings.SERVER_SIDE_FIDES_API_URL || settings.FIDES_API_URL,
+  };
+
+  return serverSideSettings;
+};
+
 /**
  * Loads all the ENV variable settings, configuration files, etc. to initialize the environment
  */
@@ -305,8 +324,6 @@ export const loadPrivacyCenterEnvironment = async ({
   // Load client settings (ensuring we only pass-along settings that are safe for the client)
   const clientSettings: PrivacyCenterClientSettings = {
     FIDES_API_URL: settings.FIDES_API_URL,
-    SERVER_SIDE_FIDES_API_URL:
-      settings.SERVER_SIDE_FIDES_API_URL || settings.FIDES_API_URL,
     DEBUG: settings.DEBUG,
     IS_OVERLAY_ENABLED: settings.IS_OVERLAY_ENABLED,
     IS_PREFETCH_ENABLED: settings.IS_PREFETCH_ENABLED,
  • clients/privacy-center/app/server-utils/getPropertyFromUrl.ts+1 −0 modified
    @@ -26,6 +26,7 @@ const getPropertyFromUrl = async ({
       result = await response.json();
     }
   } catch (e) {
+    // eslint-disable-next-line no-console
     console.log("Request to find property failed", e);
   }
  • clients/privacy-center/pages/api/fides-js.ts+10 −6 modified
    @@ -10,7 +10,10 @@ import {
   ComponentType,
   debugLog,
 } from "fides-js";
-import { loadPrivacyCenterEnvironment } from "~/app/server-environment";
+import {
+  loadPrivacyCenterEnvironment,
+  loadServerSettings,
+} from "~/app/server-environment";
 import { LOCATION_HEADERS, lookupGeolocation } from "~/common/geolocation";
 import { safeLookupPropertyId } from "~/common/property-id";
 
@@ -103,6 +106,8 @@ export default async function handler(
 ) {
   // Load the configured consent options (data uses, defaults, etc.) from environment
   const environment = await loadPrivacyCenterEnvironment();
+  const serverSettings = await loadServerSettings();
+
   let options: ConsentOption[] = [];
   if (environment.config?.consent?.page.consentOptions) {
     const configuredOptions = environment.config.consent.page.consentOptions;
@@ -158,7 +163,7 @@ export default async function handler(
       );
       experience = await fetchExperience(
         fidesRegionString,
-        environment.settings.SERVER_SIDE_FIDES_API_URL ||
+        serverSettings.SERVER_SIDE_FIDES_API_URL ||
           environment.settings.FIDES_API_URL,
         environment.settings.DEBUG,
         null,
@@ -208,9 +213,6 @@ export default async function handler(
       fidesApiUrl: environment.settings.FIDES_API_URL,
       tcfEnabled,
       gppEnabled,
-      serverSideFidesApiUrl:
-        environment.settings.SERVER_SIDE_FIDES_API_URL ||
-        environment.settings.FIDES_API_URL,
       fidesEmbed: environment.settings.FIDES_EMBED,
       fidesDisableSaveApi: environment.settings.FIDES_DISABLE_SAVE_API,
       fidesDisableNoticesServedApi:
@@ -325,8 +327,10 @@ async function fetchCustomFidesCss(
   if (shouldRefresh) {
     try {
       const environment = await loadPrivacyCenterEnvironment();
+      const serverSettings = await loadServerSettings();
+
       const fidesUrl =
-        environment.settings.SERVER_SIDE_FIDES_API_URL ||
+        serverSettings.SERVER_SIDE_FIDES_API_URL ||
         environment.settings.FIDES_API_URL;
       const response = await fetch(
         `${fidesUrl}/plus/custom-asset/custom-fides.css`
cd510216b281

Merge pull request from GHSA-53q7-4874-24qg

https://github.com/ethyca/fidesLucano VeraJul 3, 2024via ghsa
commit
8 files changed · +36 −16
  • CHANGELOG.md+4 −0 modified
    @@ -56,6 +56,10 @@ The types of changes are:
 ### Security
 - Removed FidesJS's exposure to `polyfill.io` supply chain attack [CVE-2024-38537](https://github.com/ethyca/fides/security/advisories/GHSA-cvw4-c69g-7v7m)
 
+### Security
+- Remove the SERVER_SIDE_FIDES_API_URL env variable from the client clientSettings [CVE-2024-31223](https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg)
+
+
 ## [2.39.0](https://github.com/ethyca/fides/compare/2.38.1...2.39.0)
 
 ### Added
  • clients/admin-ui/src/features/privacy-experience/preview/helpers.ts+0 −1 modified
    @@ -47,7 +47,6 @@ export const buildBaseConfig = (
     fidesApiUrl: "http://localhost:8080/api/v1",
     preventDismissal: experienceConfig.dismissable ?? false,
     allowHTMLDescription: true,
-    serverSideFidesApiUrl: "",
     fidesString: null,
     fidesJsBaseUrl: "",
     base64Cookie: false,
  • clients/fides-js/src/fides-tcf.ts+0 −1 modified
    @@ -245,7 +245,6 @@ const _Fides: FidesGlobal = {
     modalLinkId: null,
     privacyCenterUrl: "",
     fidesApiUrl: "",
-    serverSideFidesApiUrl: "",
     tcfEnabled: true,
     gppEnabled: false,
     fidesEmbed: false,
  • clients/fides-js/src/fides.ts+0 −1 modified
    @@ -183,7 +183,6 @@ const _Fides: FidesGlobal = {
     modalLinkId: null,
     privacyCenterUrl: "",
     fidesApiUrl: "",
-    serverSideFidesApiUrl: "",
     tcfEnabled: false,
     gppEnabled: false,
     fidesEmbed: false,
  • clients/fides-js/src/lib/consent-types.ts+0 −3 modified
    @@ -72,9 +72,6 @@ export interface FidesInitOptions {
   // URL for the Fides API, used to fetch and save consent preferences. Required.
   fidesApiUrl: string;
 
-  // URL for Server-side Fides API, used to fetch geolocation and consent preference. Optional.
-  serverSideFidesApiUrl: string;
-
   // Whether we should show the TCF modal
   tcfEnabled: boolean;
  • clients/privacy-center/app/server-environment.ts+21 −4 modified
    @@ -26,9 +26,15 @@ import {
 } from "~/types/config";
 
 /**
- * SERVER-SIDE functions
+ * Subset of PrivacyCenterSettings that are for use only on server-side and
+ * should never be exposed to the client.
  */
 
+export type PrivacyCenterServerSettings = Pick<
+  PrivacyCenterSettings,
+  "SERVER_SIDE_FIDES_API_URL"
+>;
+
 /**
  * Subset of PrivacyCenterSettings that are forwarded to the client.
  *
@@ -37,7 +43,6 @@ import {
 export type PrivacyCenterClientSettings = Pick<
   PrivacyCenterSettings,
   | "FIDES_API_URL"
-  | "SERVER_SIDE_FIDES_API_URL"
   | "DEBUG"
   | "GEOLOCATION_API_URL"
   | "IS_GEOLOCATION_ENABLED"
@@ -261,6 +266,20 @@ export const loadStylesFromFile = async (
   return file;
 };
 
+/**
+ * Load server settings from global environment variables
+ * The returned Server settings should never be exposed to the client
+ */
+export const loadServerSettings = (): PrivacyCenterServerSettings => {
+  const settings = loadEnvironmentVariables();
+  const serverSideSettings: PrivacyCenterServerSettings = {
+    SERVER_SIDE_FIDES_API_URL:
+      settings.SERVER_SIDE_FIDES_API_URL || settings.FIDES_API_URL,
+  };
+
+  return serverSideSettings;
+};
+
 /**
  * Loads all the ENV variable settings, configuration files, etc. to initialize the environment
  */
@@ -305,8 +324,6 @@ export const loadPrivacyCenterEnvironment = async ({
   // Load client settings (ensuring we only pass-along settings that are safe for the client)
   const clientSettings: PrivacyCenterClientSettings = {
     FIDES_API_URL: settings.FIDES_API_URL,
-    SERVER_SIDE_FIDES_API_URL:
-      settings.SERVER_SIDE_FIDES_API_URL || settings.FIDES_API_URL,
     DEBUG: settings.DEBUG,
     IS_OVERLAY_ENABLED: settings.IS_OVERLAY_ENABLED,
     IS_PREFETCH_ENABLED: settings.IS_PREFETCH_ENABLED,
  • clients/privacy-center/app/server-utils/getPropertyFromUrl.ts+1 −0 modified
    @@ -26,6 +26,7 @@ const getPropertyFromUrl = async ({
       result = await response.json();
     }
   } catch (e) {
+    // eslint-disable-next-line no-console
     console.log("Request to find property failed", e);
   }
  • clients/privacy-center/pages/api/fides-js.ts+10 −6 modified
    @@ -10,7 +10,10 @@ import {
   ComponentType,
   debugLog,
 } from "fides-js";
-import { loadPrivacyCenterEnvironment } from "~/app/server-environment";
+import {
+  loadPrivacyCenterEnvironment,
+  loadServerSettings,
+} from "~/app/server-environment";
 import { LOCATION_HEADERS, lookupGeolocation } from "~/common/geolocation";
 import { safeLookupPropertyId } from "~/common/property-id";
 
@@ -103,6 +106,8 @@ export default async function handler(
 ) {
   // Load the configured consent options (data uses, defaults, etc.) from environment
   const environment = await loadPrivacyCenterEnvironment();
+  const serverSettings = await loadServerSettings();
+
   let options: ConsentOption[] = [];
   if (environment.config?.consent?.page.consentOptions) {
     const configuredOptions = environment.config.consent.page.consentOptions;
@@ -158,7 +163,7 @@ export default async function handler(
       );
       experience = await fetchExperience(
         fidesRegionString,
-        environment.settings.SERVER_SIDE_FIDES_API_URL ||
+        serverSettings.SERVER_SIDE_FIDES_API_URL ||
           environment.settings.FIDES_API_URL,
         environment.settings.DEBUG,
         null,
@@ -208,9 +213,6 @@ export default async function handler(
       fidesApiUrl: environment.settings.FIDES_API_URL,
       tcfEnabled,
       gppEnabled,
-      serverSideFidesApiUrl:
-        environment.settings.SERVER_SIDE_FIDES_API_URL ||
-        environment.settings.FIDES_API_URL,
       fidesEmbed: environment.settings.FIDES_EMBED,
       fidesDisableSaveApi: environment.settings.FIDES_DISABLE_SAVE_API,
       fidesDisableNoticesServedApi:
@@ -325,8 +327,10 @@ async function fetchCustomFidesCss(
   if (shouldRefresh) {
     try {
       const environment = await loadPrivacyCenterEnvironment();
+      const serverSettings = await loadServerSettings();
+
       const fidesUrl =
-        environment.settings.SERVER_SIDE_FIDES_API_URL ||
+        serverSettings.SERVER_SIDE_FIDES_API_URL ||
         environment.settings.FIDES_API_URL;
       const response = await fetch(
         `${fidesUrl}/plus/custom-asset/custom-fides.css`

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.