PT-2023-31623 · Resque · Resque

G-Rath · Published 2023-12-18 · Updated 2024-01-02 · CVE-2023-50724

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Resque versions prior to 2.1.0

Description The issue is related to reflected Cross Site Scripting (XSS) through the current queue parameter in the path of the queues endpoint. This allows for potential exploitation by manipulating the endpoint path. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. The technical details about exploitation include the use of the current queue parameter in the queues endpoint.

Recommendations For Resque versions prior to 2.1.0, update to version 2.1.0 to resolve the issue. As a temporary workaround, consider avoiding clicks on 3rd party or untrusted links to the resque-web interface until the application is patched.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-233

Related Identifiers

CVE-2023-50724

GHSA-R8XX-8VM8-X6WJ

Affected Products

Resque

References · 14

• 🔥 https://github.com/resque/resque/issues/1679 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50724.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50724.yml · Exploit
• https://github.com/resque/resque/security/advisories/GHSA-r8xx-8vm8-x6wj · Vendor Advisory
• https://github.com/resque/resque/pull/1687 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-50724 · Security Note
• https://osv.dev/vulnerability/GHSA-r8xx-8vm8-x6wj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50724 · Vendor Advisory
• https://github.com/resque/resque/commit/e8e2367fff6990d13109ec2483a456a05fbf9811 · Note
• https://github.com/resque/resque · Note
• https://t.me/cvenotify/65970 · Telegram Post
• https://twitter.com/rubylandnews/status/1737236507025445118 · Twitter Post
• https://twitter.com/CVEnew/status/1737854384879571123 · Twitter Post
• https://twitter.com/RedPacketSec/status/1738500705009209510 · Twitter Post