Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-46126

CVE-2023-46126:
Fides JavaScript Injection Vulnerability in Privacy Center URL

3.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-46126
GHSA ID
GHSA-fgjj-5jmr-gh83
EPSS Score
0.35325%
CWE
CWE-79
Published
10/24/2023
Updated
11/9/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
ethyca-fidespip< 2.22.12.22.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from lack of URL validation in the privacy_policy_url field. The patch replaced the basic string type with Pydantic's HttpUrl type which enforces proper URL validation. The commit diff shows:

  1. Original vulnerable code used 'Optional[str]' without validation
  2. Patched code uses 'Optional[HttpUrl]' with Pydantic's URL validation
  3. Test cases added to reject invalid URLs like 'javascript:alert()' The schema field's lack of validation directly enabled XSS payload injection when the URL was rendered in integrated websites.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *i**s w** *ppli**tion *llows us*rs to **it *ons*nt *n* priv**y noti**s su** *s *ooki* **nn*rs. T**s* priv**y noti**s **n t**n ** s*rv** *y ot**r int**r*t** w**sit*s, *or *x*mpl* in *ooki* *ons*nt **nn*rs. On* o* t** **it**l* *i*l*s is

Reasoning

T** vuln*r**ility st*mm** *rom l**k o* URL v*li**tion in t** priv**y_poli*y_url *i*l*. T** p*t** r*pl**** t** **si* strin* typ* wit* Py**nti*'s *ttpUrl typ* w*i** *n*or**s prop*r URL v*li**tion. T** *ommit *i** s*ows: *. Ori*in*l vuln*r**l* *o** us**