Description

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim’s browser.

Proof of Concept

There must have been a metrics during the default value of the period parameter. You simply have to set the payload in the period parameter. Payload : "><img/src/onerror=alert(document.domain)>

Example of URL with payload :

• https://localhost/sidekiq/metrics?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E
• https://localhost/sidekiq/metrics/SanityChecksJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E
• https://localhost/sidekiq/metrics/ActiveStorage::PurgeJob?period=%22%3E%3Cimg/src/onerror=alert(document.domain)%3E

Impact

An XSS vulnerability on a Sidekiq admin panel can pose serious risks to the security and functionality of the system. In particular, this type of vulnerability can allow an attacker to execute malicious code within the context of the Sidekiq admin panel, which can potentially stop the process, leak all the metrics, and even remove the queue altogether.

Stopping the process is one of the most severe consequences of an XSS attack on Sidekiq, as it can lead to a complete halt of the system’s operations. This can have significant implications for businesses or organizations that rely on Sidekiq to manage their background jobs and tasks. If the process is stopped, critical tasks such as sending emails, processing payments, or performing other time-sensitive functions can be disrupted, leading to potential losses of revenue or reputation.

Leaking all the metrics is another risk that can result from an XSS vulnerability on a Sidekiq admin panel. Metrics provide valuable information about the system’s performance, and an attacker who gains access to this data can potentially use it to identify vulnerabilities or weaknesses in the system. This can lead to further attacks or exploitation, putting the system and its users at risk.

Removing the queue is yet another consequence of an XSS attack on Sidekiq. The queue is an essential component of Sidekiq, responsible for managing and prioritizing the background jobs and tasks. If an attacker can remove the queue, all the pending jobs and tasks will be lost, potentially leading to data loss or disruption of critical business processes.

In summary, an XSS vulnerability on a Sidekiq admin panel can have severe consequences, including stopping the process, leaking all the metrics, and removing the queue. It is essential for organizations to take proactive measures to mitigate these risks by implementing robust security measures, such as regularly updating software, configuring proper access controls, and implementing web application firewalls.

原文始发于huntr：Reflected XSS on Sidekiq through multiples endpoints via GET parameter “period” in sidekiq/sidekiq