CVE-2024-32657: Hydra has persistent XSS vulnerability serving HTML build outputs
Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS .iso files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32657?
CVE-2024-32657 has been assessed as a high severity vulnerability due to the potential for arbitrary code execution in a user's browser.
How do I fix CVE-2024-32657?
To mitigate CVE-2024-32657, update Nix Hydra to the latest stable version that addresses the vulnerability.
Who is affected by CVE-2024-32657?
CVE-2024-32657 affects users running unstable versions of Nix Hydra or version 23.11.
What type of attack is enabled by CVE-2024-32657?
CVE-2024-32657 allows attackers to execute arbitrary code in the browser context of Hydra, potentially leading to unauthorized HTTP requests.
What features of Nix Hydra are exploited in CVE-2024-32657?
The vulnerability exploits features that allow Nix builds to specify files served by Hydra to clients, leading to code execution risks.