Insufficient verification of data authenticity in Sidekiq - CVE-2023-26141

Vulnerability identifier: #VU86416

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26141

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient checks in the dashboard-charts.js file. A remote user can manipulate the localStorage value which will cause excessive polling requests.

Sidekiq
Red Hat Satellite
Red Hat Enterprise Linux for x86_64
satellite-convert2rhel-toolkit (Red Hat package)
rubygem-grpc (Red Hat package)
mosquitto (Red Hat package)
python-pulp-container (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
rubygem-google-protobuf (Red Hat package)
candlepin (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-puma (Red Hat package)
rubygem-sidekiq (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)

Install updates from vendor's website.

Sidekiq - addressed in versions 6.5.10, 7.1.3
Red Hat Satellite - update to 6.14.2
satellite-convert2rhel-toolkit (Red Hat package) - update to 1.0.1-1.el8sat
rubygem-grpc (Red Hat package) - update to 1.58.0-1.el8sat
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
foreman-installer (Red Hat package) - update to 3.7.0.7-1.el8sat
foreman (Red Hat package) - update to 3.7.0.11-2.el8sat
rubygem-google-protobuf (Red Hat package) - update to 3.24.3-1.el8sat
candlepin (Red Hat package) - update to 4.3.11-1.el8sat
rubygem-katello (Red Hat package) - update to 4.9.0.21-1.el8sat
rubygem-puma (Red Hat package) - update to 6.3.1-1.el8sat
rubygem-sidekiq (Red Hat package) - update to 6.5.12-1.el8sat
satellite (Red Hat package) - update to 6.14.2-1.el8sat
rubygem-kafo (Red Hat package) - update to 7.2.0-1.el8sat
puppetserver (Red Hat package) - update to 7.14.0-1.el8sat
puppet-agent (Red Hat package) - update to 7.27.0-1.el8sat
rubygem-foreman_bootdisk (Red Hat package) - update to 21.2.1-1.el8sat

• https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a
• https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6
• https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89
• https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107

• Denial of service in Sidekiq
• Multiple vulnerabilities in Red Hat Satellite 6.14