PT-2023-31625 · Resque · Resque

Patrick Tulskie + 1 · Published 2023-12-18 · Updated 2024-01-03 · CVE-2023-50727

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Resque versions prior to 2.6.0

Description A reflected XSS issue occurs when the /queues endpoint is appended with malicious input, such as "><svg onload=alert(domain)>. This allows for cross-site scripting attacks. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. The /queues endpoint is vulnerable, specifically the current queue portion of the path.

Recommendations For versions prior to 2.6.0, update to version 2.6.0 to resolve the issue. As a temporary workaround, consider avoiding clicks on third-party or untrusted links to the resque-web interface until the application is patched. Restrict access to the /queues endpoint to minimize the risk of exploitation. Avoid using untrusted input in the current queue portion of the path until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-233

CWE-79

Related Identifiers

CVE-2023-50727

GHSA-R9MQ-M72X-257G

Affected Products

Resque

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50727.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resque/CVE-2023-50727.yml · Exploit
• https://github.com/resque/resque/pull/1865 · Patch
• https://github.com/resque/resque/security/advisories/GHSA-r9mq-m72x-257g · Vendor Advisory
• https://github.com/resque/resque/commit/7623b8dfbdd0a07eb04b19fb25b16a8d6f087f9a · Patch
• https://osv.dev/vulnerability/GHSA-r9mq-m72x-257g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50727 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50727 · Vendor Advisory
• https://github.com/resque/resque · Note
• https://twitter.com/CVEnew/status/1738295161892049033 · Twitter Post
• https://twitter.com/rubylandnews/status/1737236505079271895 · Twitter Post
• https://twitter.com/RedPacketSec/status/1738500706133324270 · Twitter Post