CVE-2024-32887 Reflected XSS in sidekiq

2024-04-2621:02:42

CWE-79

GitHub_M

github.com

cve-2024-32887

reflected xss

sidekiq

injection

javascript

sidekiq web ui

domain

application

patched

security vulnerability

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

AI Score

6.1

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:sidekiq:sidekiq:*:*:*:*:*:*:*:*"
    ],
    "vendor": "sidekiq",
    "product": "sidekiq",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]