CVE-2024-32887: Insufficient Information (NVD-CWE-noinfo)
value: Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application.  An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. This issue has been patched in version 7.2.4.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-26T21:15Z
Repository: https://github.com/sidekiq/sidekiq
Language: Ruby
Files changed: Changes.md, lib/sidekiq/version.rb, web/views/metrics.erb
Commit date: 2024-04-26 13:44:52 -0700
Commit message: Fix for CVE-2024-32887

Diff: diff --git a/Changes.md b/Changes.md
index 4205bd98a..34fdca729 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,9 +1,15 @@
 # Sidekiq Changes
 
 [Sidekiq Changes](https://github.com/sidekiq/sidekiq/blob/main/Changes.md) | [Sidekiq Pro Changes](https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/sidekiq/sidekiq/blob/main/Ent-Changes.md)
 
+7.2.4
+----------
+
+- Fix XSS in metrics filtering introduced in 7.2.0, CVE-2024-32887
+  Thanks to @UmerAdeemCheema for the security report.
+
 7.2.3
 ----------
 
 - [Support Dragonfly.io](https://www.mikeperham.com/2024/02/01/supporting-dragonfly/) as an alternative Redis implementation
 - Fix error unpacking some compressed error backtraces [#6241]
diff --git a/lib/sidekiq/version.rb b/lib/sidekiq/version.rb
index 1171e582f..e93ed589d 100644
--- a/lib/sidekiq/version.rb
+++ b/lib/sidekiq/version.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "7.2.3"
+  VERSION = "7.2.4"
   MAJOR = 7
 end
diff --git a/web/views/metrics.erb b/web/views/metrics.erb
index c440e67ac..5eefa33ff 100644
--- a/web/views/metrics.erb
+++ b/web/views/metrics.erb
@@ -10,11 +10,11 @@
 
   <div>
     <form id="metrics-form" class="form-inline" action="<%= root_path %>filter/metrics" method="post">
       <%= csrf_tag %>
       <label for="substr"><%= t('Filter') %></label>
-      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= params[:substr] %>">
+      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= h params[:substr] %>">
       <select id="period-selector" class="form-control" name="period">
         <% @periods.each_key do |code| %>
           <% if code == @period %>
             <option selected value="<%= code %>"><%= code %></option>
           <% else %>

Vulnerable code:   VERSION = "7.2.3"
      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= params[:substr] %>">
Fixed code: 7.2.4
----------

- Fix XSS in metrics filtering introduced in 7.2.0, CVE-2024-32887
  Thanks to @UmerAdeemCheema for the security report.

  VERSION = "7.2.4"
      <input id="class-filter" class="form-control" type="text" name="substr" placeholder="<%= t('Name') %>" value="<%= h params[:substr] %>">