Updated advisory posts against rubysec/ruby-advisory-db@fb42fad

Author: jasnow

advisories/_posts/2024-02-13-CVE-2024-25122.md

@@ -0,0 +1,54 @@
+---
+layout: advisory
+title: 'CVE-2024-25122 (sidekiq-unique-jobs): sidekiq-unique-jobs UI server vulnerable
+  to XSS & RCE in Redis'
+comments: false
+categories:
+- sidekiq-unique-jobs
+advisory:
+  gem: sidekiq-unique-jobs
+  cve: 2024-25122
+  ghsa: cmh9-rx85-xj38
+  url: https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
+  title: sidekiq-unique-jobs UI server vulnerable to XSS & RCE in Redis
+  date: 2024-02-13
+  description: |
+    Cross site scripting (XSS) potentially exposing cookies / sessions / localStorage, fixed by sidekiq-unique-jobs v8.0.7.
+
+    ### Details
+
+    Specially crafted URL query parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI,
+    allow a super-user attacker, or an unwitting, but authorized, victim, who has received a disguised / crafted link,
+    to successfully execute malicious code, which could potentially steal cookies, session data,
+    or local storage data from the app the sidekiq-unique-jobs web UI is mounted in.
+
+    If your sidekiq-unique-jobs web UI is mounted at `/sidekiq`, the vulnerable paths and query parameters are:
+
+    * `/sidekiq/changelogs`
+      * `filter`
+      * `count`
+    * `/sidekiq/locks`
+      * `filter`
+      * `count`
+    * `/sidekiq/expiring_locks`
+      * `filter`
+
+    ### Impact
+
+    This is a vulnerability of critical severity, which impacts many thousands of sites, since sidekiq-unique-jobs is widely deployed across the industry, with multiple attack vectors.
+
+    ### Patches
+
+    The fix for the XSS vulnerability was released in sidekiq-unique-jobs v8.0.7.
+  cvss_v3: 7.1
+  patched_versions:
+  - "~> 7.1.33"
+  - ">= 8.0.7"
+  related:
+    url:
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/cd09ba6108f98973b6649a6149790c3d4502b4cc
+    - https://github.com/mhenrixon/sidekiq-unique-jobs/commit/ec3afd920c1b55843c72f748a87baac7f8be82ed
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-25122
+    - https://github.com/advisories/GHSA-cmh9-rx85-xj38
+---