PT-2023-31624 · Resque · Resque

Madslundholmdk + 1 · Published 2023-12-18 · Updated 2024-01-03 · CVE-2023-50725

Positive Technologies · (AI Summary)

CVSS v3.1

6.3

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions:

Resque versions prior to 2.2.1

Description:

The issue concerns a reflected XSS vulnerability in the resque-web component of the Resque library. Specifically, the vulnerability affects the following paths: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This allows for the execution of malicious scripts when a user clicks on a specially crafted link to the resque-web interface. To mitigate this risk, it is recommended not to click on third-party or untrusted links to the resque-web interface until the application is patched.

Recommendations:

For versions prior to 2.2.1, update to version 2.2.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the vulnerable paths in the resque-web interface until a patch is applied. Additionally, restrict access to the resque-web interface to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-233

CWE-79

Related Identifiers

CVE-2023-50725

GHSA-GC3J-VVWF-4RP8

Affected Products

Resque

References · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50725.yml · Exploit
• https://github.com/resque/resque/commit/ee99d2ed6cc75d9d384483b70c2d96d312115f07 · Patch
• https://github.com/resque/resque/pull/1790 · Patch
• https://github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50725 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gc3j-vvwf-4rp8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50725 · Security Note
• https://github.com/resque/resque · Note
• https://twitter.com/rubylandnews/status/1737236506148823095 · Twitter Post
• https://twitter.com/RedPacketSec/status/1738500703868367306 · Twitter Post
• https://twitter.com/CVEnew/status/1738295162814808388 · Twitter Post