Skip to content

Persistent XSS serving HTML build outputs

Moderate
dasJ published GHSA-2p75-6g9f-pqgx Apr 22, 2024

Package

Hydra

Affected versions

8b4857959357862d3e25c9783c85c6fdf129741c and older

Patched versions

b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3 and later

Description

Impact

Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests on behalf of the user.

The feature that is being abused is that Hydra can directly serve build results. This is for example used, when serving .iso files for images not published through the homepage. In this case the issue only affects build results, that are HTML files.

For https://hydra.nixos.org the relevant patch has been applied since around 2024-04-21 14:30 UTC.

Patches

  • Packages in nixpkgs have fixing PRs in unstable and 23.11
  • Apply the patch to your hydra package

Workarounds

  • Make sure to only build trusted inputs
  • Be careful when opening links to direct build results from Hydra

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CVE ID

CVE-2024-32657

Weaknesses

Credits