Exposure of Sensitive System Information to an Unauthorized Control Sphere in ethyca-fides

Summary

Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, "and/or" port. A vulnerability present starting in ethyca-fides package version 2.19.0rc6 through 2.39.2b0, allows an unauthenticated attacker to make an HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, "and/or" private domain names. This vulnerability has been patched in 2.39.2rc0. No known workarounds are available.