Executive Summary

This vulnerability affects the Fides Webserver API's built-in IP-based rate limiting prior to version 2.69.1. The rate limiting is ineffective in environments using CDNs, proxies, or load balancers because it applies limits based on infrastructure IPs rather than the actual client IPs. Additionally, rate limit counters are stored in-memory instead of a shared store, allowing attackers to bypass rate limits and potentially cause denial of service. The issue only affects deployments relying on Fides's built-in rate limiting and is fixed in version 2.69.1.

Useful 0 Not Useful 0

Impact Analysis

An attacker can bypass the intended rate limits on the Fides Webserver API, potentially causing a denial of service by overwhelming the system. This can disrupt service availability for legitimate users. The impact is limited to deployments that rely solely on Fides's built-in rate limiting and do not use external rate limiting solutions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Fides to version 2.69.1 or later to fix the ineffective built-in IP-based rate limiting. If upgrading is not immediately possible, implement external rate limiting at the infrastructure level using a Web Application Firewall (WAF), API Gateway, or similar technology, as there are no application-level workarounds.

Useful 0 Not Useful 0