CVE-2024-38537: Insufficient Information (NVD-CWE-noinfo)
value: Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the `polyfill.io` domain when the domain was compromised and serving malware. No exploitation of `fides.js` via `polyfill.io` has been identified as of time of publication.

The vulnerability has been patched in Fides version `2.39.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure `polyfill.io` and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable. Prior to the domain level intervention, there were no server-side workarounds and the confidentiality, integrity, and availability impacts of this vulnerability were high. Clients could ensure they were not affected by using a modern browser that supported the fetch standard.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-02T20:15Z
Repository: https://github.com/ethyca/fides
Language: Markdown
Files changed: CHANGELOG.md, clients/privacy-center/pages/api/fides-js.ts
Commit date: 2024-06-26 18:00:58 -0600
Commit message: Remove fetch polyfill from FidesJS (#5026)


Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 97295e5c1..a7a7727ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,16 +21,16 @@ The types of changes are:
 - Adds last_monitored and enabled attributes to MonitorConfig [#4991](https://github.com/ethyca/fides/pull/4991)
 - New messaging page. Allows managing messaging templates for different properties. [#5005](https://github.com/ethyca/fides/pull/5005)
 
 ### Changed
 - Navigation changes. 'Management' was renamed 'Settings'. Properties was moved to Settings section. [#5005](https://github.com/ethyca/fides/pull/5005)
-
-
-### Changed
 - Changed discovery monitor form behavior around execution date/time selection [#5017](https://github.com/ethyca/fides/pull/5017)
 - Changed integration form behavior when errors occur [#5023](https://github.com/ethyca/fides/pull/5023)
 
+### Removed
+- Removed the `fetch` polyfill from FidesJS (#5026)[https://github.com/ethyca/fides/pull/5026]
+
 ### Fixed
 - Fixed intermittent connection issues with Redshift by increasing timeout and preferring SSL in test connections [#4981](https://github.com/ethyca/fides/pull/4981)
 
 ## [2.39.0](https://github.com/ethyca/fides/compare/2.38.1...2.39.0)
 
diff --git a/clients/privacy-center/pages/api/fides-js.ts b/clients/privacy-center/pages/api/fides-js.ts
index b38007885..0513d4a3f 100644
--- a/clients/privacy-center/pages/api/fides-js.ts
+++ b/clients/privacy-center/pages/api/fides-js.ts
@@ -269,17 +269,10 @@ export default async function handler(
   const { initialize: initializeQuery } = req.query;
   const skipInitialization = initializeQuery === "false";
 
   const script = `
   (function () {
-    // This polyfill service adds a fetch polyfill only when needed, depending on browser making the request
-    if (!window.fetch) {
-      var script = document.createElement('script');
-      script.src = 'https://polyfill.io/v3/polyfill.min.js?features=fetch';
-      document.head.appendChild(script);
-    }
-
     // Include generic fides.js script and GPP extension (if enabled)
     ${fidesJS}${fidesGPP}${
     customFidesCss
       ? `
     // Include custom fides.css styles

Vulnerable code: 

### Changed
    // This polyfill service adds a fetch polyfill only when needed, depending on browser making the request
    if (!window.fetch) {
      var script = document.createElement('script');
      script.src = 'https://polyfill.io/v3/polyfill.min.js?features=fetch';
      document.head.appendChild(script);
    }

Fixed code: ### Removed
- Removed the `fetch` polyfill from FidesJS (#5026)[https://github.com/ethyca/fides/pull/5026]