Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. ethyca-fides
  4. ›
  5. CVE-2024-45053

CVE-2024-45053: Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

September 4, 2024 (updated November 18, 2024)

The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or Contributor role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed.

References

  • github.com/advisories/GHSA-c34r-238x-f7qx
  • github.com/ethyca/fides
  • github.com/ethyca/fides/commit/829cbd9cb5ef9c814fbac1ed6800e8d939d359c5
  • github.com/ethyca/fides/security/advisories/GHSA-c34r-238x-f7qx
  • nvd.nist.gov/vuln/detail/CVE-2024-45053

Code Behaviors & Features

Detect and mitigate CVE-2024-45053 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 2.19.0 before 2.44.0

Fixed versions

  • 2.44.0

Solution

Upgrade to version 2.44.0 or above.

Impact 7.2 HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

pypi/ethyca-fides/CVE-2024-45053.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:15 +0000.