PT-2024-24749 · Hydra · Hydra

Delroth · Published 2024-04-22 · Updated 2024-04-23 · CVE-2024-32657

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hydra versions prior to the fix commit applied around 2024-04-21 14:30 UTC

Description Hydra, a Continuous Integration service for Nix-based projects, has an issue that allows attackers to execute arbitrary code in the browser context and execute authenticated HTTP requests. The problem arises from a feature that lets Nix builds specify files served by Hydra to clients, particularly affecting HTML files. This issue can be worked around by not opening HTML build artifacts until the vulnerability is fixed.

Recommendations For versions prior to the fix commit, apply the fix commit to local installations to resolve the issue. For users of the nixpkgs package, update to unstable or 23.11 to obtain the fixed version. As a temporary workaround, consider not opening HTML build artifacts until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32657

GHSA-2P75-6G9F-PQGX

Affected Products

Hydra

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32657.json · Exploit
• https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3 · Patch
• https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32657 · Security Note
• https://github.com/NixOS/nixpkgs/pull/306018 · Note
• https://github.com/NixOS/nixpkgs/pull/306017 · Note
• https://t.me/cvenotify/77712 · Telegram Post
• https://t.me/cvenotify/77762 · Telegram Post