CVE-2024-32657

Hydra has persistent XSS vulnerability serving HTML build outputs

Severity Score

4.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.

Hydra es un servicio de integración continua para proyectos basados en Nix. Los atacantes pueden ejecutar código arbitrario en el contexto del navegador de Hydra y ejecutar solicitudes HTTP autenticadas. La característica abusada permite que las compilaciones de Nix especifiquen los archivos que Hydra entrega a los clientes. Un uso de esta funcionalidad es servir archivos `.iso` de NixOS. El problema es sólo con los archivos html proporcionados por Hydra. El problema se solucionó en https://hydra.nixos.org alrededor del 21 de abril de 2024 a las 14:30 UTC. El paquete nixpkgs se corrigió en inestable y 23.11. Los usuarios con paquetes Hydra personalizados pueden aplicar la confirmación de corrección a sus instalaciones locales. La vulnerabilidad solo se activa al abrir artefactos de compilación HTML, por lo que no abrirlos hasta que se solucione la vulnerabilidad soluciona el problema.

*Credits: N/A

CVSS Scores

GitHubv3.1 4.6

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-04-16 CVE Reserved
2024-04-22 CVE Published
2024-04-23 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (4)

URL	Tag	Source
https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3	X_refsource_misc
https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx	X_refsource_confirm
https://github.com/NixOS/nixpkgs/pull/306017	X_refsource_misc
https://github.com/NixOS/nixpkgs/pull/306018	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
NixOS Search vendor "NixOS"		Hydra Search vendor "NixOS" for product "Hydra"				< Search vendor "NixOS" for product "Hydra" and version " < "		en		Affected
NixOS Search vendor "NixOS"		Hydra Search vendor "NixOS" for product "Hydra"				< 23.11 Search vendor "NixOS" for product "Hydra" and version " < 23.11"		en		Affected