Vulnerability · Published Apr 26, 2024 · Assigned by GitHub_M

CVE-2024-32887Reflected XSS in sidekiq

Medium 5.5

In plain English

A medium-severity cross-site scripting in sidekiq from sidekiq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.6%top 51.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	sidekiq	7.2.4	GHSA-q655-3pj8-9fxq

Affected products (as reported)

Vendor	Product	Versions
sidekiq	sidekiq	>= 7.2.0, < 7.2.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/sidekiq/sidekiq/security/advisories/GHSA-q655-3pj8-9fxq x_refsource_CONFIRM
https://github.com/sidekiq/sidekiq/commit/30786e082c70349ab27ffa9eccc42fb0c696164d x_refsource_MISC
https://github.com/sidekiq/sidekiq/releases/tag/v7.2.4 x_refsource_MISC