Reflected XSS in sidekiq
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sidekiq | sidekiq | 7.2.0 to before 7.2.4 | 7.2.4 | Patch available | CNA |
| — | sidekiq (RubyGems) | 7.2.0 to before 7.2.4 | 7.2.4 | Patch available | GHSA-q655-3pj8-9fxq |
- sidekiq Vendorsidekiq Affected 7.2.0 to before 7.2.4 Fixed in 7.2.4 Patch available CNA
- sidekiq (RubyGems) Vendor— Affected 7.2.0 to before 7.2.4 Fixed in 7.2.4 Patch available GHSA-q655-3pj8-9fxq
Remediation
- Fix · CNA sidekiq (sidekiq) Fixed in 7.2.4
- Fix · GHSA-q655-3pj8-9fxq sidekiq (RubyGems) Fixed in 7.2.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-32887
- 2026-10-03 Alias added: GHSA-q655-3pj8-9fxq
References
Other 5
- https://github.com/sidekiq/sidekiq/security/advisories/GHSA-q655-3pj8-9fxq
- https://github.com/sidekiq/sidekiq/commit/30786e082c70349ab27ffa9eccc42fb0c696164d
- https://github.com/sidekiq/sidekiq/releases/tag/v7.2.4
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sidekiq/CVE-2024-32887.yml
- https://github.com/sidekiq/sidekiq
Sources
- CVE-2024-32887 · CVE Program
- CVE-2024-32887 · NVD
- FIRST EPSS
- GHSA-q655-3pj8-9fxq · GitHub Advisory Database · CC BY 4.0
- CVE-2024-32887 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences