From 5446d01c9d71c10e800ab79137a016367023d78c Mon Sep 17 00:00:00 2001 From: Patrick Tulskie Date: Mon, 2 Nov 2026 08:48:05 -0500 Subject: [PATCH] Six new resque and resque-scheduler advisories --- gems/resque-scheduler/GHSA-56gg-9g3j-m653.yml | 48 ++++++++++ gems/resque-scheduler/GHSA-g7vm-3ppj-xxrj.yml | 44 +++++++++ gems/resque/GHSA-5r7x-x5pm-94xj.yml | 53 +++++++++++ gems/resque/GHSA-m39q-9jm7-xp4q.yml | 38 ++++++++ gems/resque/GHSA-r23w-h6cg-h95q.yml | 65 +++++++++++++ gems/resque/GHSA-r5h4-xh93-f339.yml | 93 +++++++++++++++++++ 6 files changed, 341 insertions(+) create mode 100644 gems/resque-scheduler/GHSA-56gg-9g3j-m653.yml create mode 100644 gems/resque-scheduler/GHSA-g7vm-3ppj-xxrj.yml create mode 100644 gems/resque/GHSA-5r7x-x5pm-94xj.yml create mode 100644 gems/resque/GHSA-m39q-9jm7-xp4q.yml create mode 100644 gems/resque/GHSA-r23w-h6cg-h95q.yml create mode 100644 gems/resque/GHSA-r5h4-xh93-f339.yml diff --git a/gems/resque-scheduler/GHSA-56gg-9g3j-m653.yml b/gems/resque-scheduler/GHSA-56gg-9g3j-m653.yml new file mode 100644 index 0000000000..c6094dc84f --- /dev/null +++ b/gems/resque-scheduler/GHSA-56gg-9g3j-m653.yml @@ -0,0 +1,48 @@ +--- +gem: resque-scheduler +ghsa: 56gg-9g3j-m653 +url: https://github.com/resque/resque-scheduler/security/advisories/GHSA-56gg-9g3j-m653 +title: Stored XSS in resque-scheduler web UI through job class and queue names +date: 2026-10-11 +description: | + ### Summary + + Job class names and queue names read back out of Redis were rendered + into the resque-scheduler web UI without escaping, in both text nodes + and `value` attributes. Anyone able to enqueue a job (or otherwise + write to Redis) can store markup that executes when an operator views + the delayed jobs pages. + + ### Details + + The affected surfaces: + + - **`/delayed/:timestamp`**: the job class of every delayed job at + that timestamp + - **`/delayed/search` results**: the job class of matching delayed + jobs, both as text and inside the hidden `klass` input of the + "Cancel Job" form, plus the queue and class of matching queued and + working jobs + + Neither the class nor the queue name is validated when a job is + enqueued, so any string an application passes through ends up in the + page as-is. + + Fixed in https://github.com/resque/resque-scheduler/pull/830 + + ### Impact + + Script runs in the operator's browser with their resque-web session. + It can do anything the operator can do there: read job arguments, + delete queues, clear delayed and failed jobs, and queue scheduled + jobs. When resque-web is mounted inside a Rails app, it runs on the + app's origin, so it has the operator's session there as well. +cvss_v4: 5.1 +patched_versions: + - ">= 5.0.1" +related: + url: + - https://github.com/resque/resque-scheduler/security/advisories/GHSA-56gg-9g3j-m653 + - https://github.com/resque/resque-scheduler/pull/830 +notes: | + - A CVE has been requested for this GHSA and can be added once assigned. diff --git a/gems/resque-scheduler/GHSA-g7vm-3ppj-xxrj.yml b/gems/resque-scheduler/GHSA-g7vm-3ppj-xxrj.yml new file mode 100644 index 0000000000..f279a15f1c --- /dev/null +++ b/gems/resque-scheduler/GHSA-g7vm-3ppj-xxrj.yml @@ -0,0 +1,44 @@ +--- +gem: resque-scheduler +ghsa: g7vm-3ppj-xxrj +url: https://github.com/resque/resque-scheduler/security/advisories/GHSA-g7vm-3ppj-xxrj +title: >- + Stored XSS in resque-scheduler requeue page through schedule names + and parameters +date: 2026-10-11 +description: | + ### Summary + + The page shown when queueing a parameterized schedule rendered the + schedule name and its `parameters` keys, descriptions and defaults + without escaping, both as text and inside HTML attributes. An + application that builds dynamic schedules from user input lets that + input run as script in an operator's browser. + + Fixed in: https://github.com/resque/resque-scheduler/pull/831 + + ### Details + + Clicking "Queue now" on `/schedule` for a schedule that defines + `parameters` posts to `/schedule/requeue`. That renders a form built + from the schedule's name and parameter definitions. The schedule list + on `/schedule` itself was already escaped, so the payload only runs + once the operator clicks through. + + ### Impact + + Script runs in the operator's browser with their resque-web session. + It can do anything the operator can do there: read job arguments, + delete queues, clear delayed and failed jobs, and queue scheduled jobs + with chosen parameters. When resque-web is mounted inside a Rails app, + it runs on the app's origin, so it has the operator's session there as + well. +cvss_v4: 2.0 +patched_versions: + - ">= 5.0.1" +related: + url: + - https://github.com/resque/resque-scheduler/security/advisories/GHSA-g7vm-3ppj-xxrj + - https://github.com/resque/resque-scheduler/pull/831 +notes: | + - A CVE has been requested for this GHSA and can be added once assigned. diff --git a/gems/resque/GHSA-5r7x-x5pm-94xj.yml b/gems/resque/GHSA-5r7x-x5pm-94xj.yml new file mode 100644 index 0000000000..8d273c9c63 --- /dev/null +++ b/gems/resque/GHSA-5r7x-x5pm-94xj.yml @@ -0,0 +1,53 @@ +--- +gem: resque +ghsa: 5r7x-x5pm-94xj +url: https://github.com/resque/resque/security/advisories/GHSA-5r7x-x5pm-94xj +title: Reflected XSS through the request path in the resque-web poll link +date: 2026-09-09 +description: | + ### Impact + + The "Live Poll!!" link rendered on the `/overview` and `/workers` + pages interpolated the raw request path into an `href` attribute + without escaping it. + + Browsers do not percent-encode apostrophes in a URL path, so an + apostrophe reaches `PATH_INFO` literally and breaks out of the + single-quoted attribute: + + ``` + /overview/x'onmouseover='alert(document.domain) + /workers/x'onmouseover='alert(document.domain) + ``` + + Which renders as: + + ```html + Live Poll!! + ``` + + No prior access to the application is required — a single crafted + link is enough. + + ### Patches + + v3.0.2 + + ### Workarounds + + No known workarounds at this time. It is recommended to not click + on 3rd party or untrusted links to the resque-web interface until + you have patched your application. + + ### References + + https://github.com/resque/resque/pull/1946 +cvss_v4: 5.1 +patched_versions: + - ">= 3.0.2" +related: + url: + - https://github.com/resque/resque/security/advisories/GHSA-5r7x-x5pm-94xj + - https://github.com/resque/resque/pull/1946 +notes: | + - A CVE has been requested for this GHSA and can be added once assigned. diff --git a/gems/resque/GHSA-m39q-9jm7-xp4q.yml b/gems/resque/GHSA-m39q-9jm7-xp4q.yml new file mode 100644 index 0000000000..9cd6902897 --- /dev/null +++ b/gems/resque/GHSA-m39q-9jm7-xp4q.yml @@ -0,0 +1,38 @@ +--- +gem: resque +ghsa: m39q-9jm7-xp4q +url: https://github.com/resque/resque/security/advisories/GHSA-m39q-9jm7-xp4q +title: Reflected XSS in the resque-web stats/keys endpoint +date: 2026-09-09 +description: | + ### Impact + + The following paths in resque-web have been found to be vulnerable + to reflected XSS: + + ``` + /stats/keys/ + ``` + + ### Patches + + v3.0.1 + + ### Workarounds + + No known workarounds at this time. It is recommended to not click + on 3rd party or untrusted links to the resque-web interface until + you have patched your application. + + ### References + + https://github.com/resque/resque/pull/1942 +cvss_v3: 6.3 +patched_versions: + - ">= 3.0.1" +related: + url: + - https://github.com/resque/resque/security/advisories/GHSA-m39q-9jm7-xp4q + - https://github.com/resque/resque/pull/1942 +notes: | + - A CVE has been requested for this GHSA and can be added once assigned. diff --git a/gems/resque/GHSA-r23w-h6cg-h95q.yml b/gems/resque/GHSA-r23w-h6cg-h95q.yml new file mode 100644 index 0000000000..ca6294e774 --- /dev/null +++ b/gems/resque/GHSA-r23w-h6cg-h95q.yml @@ -0,0 +1,65 @@ +--- +gem: resque +ghsa: r23w-h6cg-h95q +url: https://github.com/resque/resque/security/advisories/GHSA-r23w-h6cg-h95q +title: >- + Stored XSS in resque-web through queue names, worker IDs, and job + payloads +date: 2026-09-09 +description: | + ### Impact + + Values read back out of Redis were rendered into resque-web without + escaping, in both text nodes and `href` attributes. Anyone able to + enqueue a job (or otherwise write to Redis) can store markup that + executes when an operator loads the admin UI. + + The affected surfaces: + + - **Queue names** — `/queues`, `/queues/:id`, and the queue sidebar + on every page that renders it + - **Worker IDs** (`hostname:pid:queues`) — `/workers`, + `/workers/:id`, `/working` + - **Job class names and payload data** — the shared job class + partial, used by the queues, workers, working and failed pages + - **Failed job details** (worker, queue, exception) — `/failed` + - **Redis key names and values** — `/stats/keys` and + `/stats/keys/:key` + - **`/stats.txt`** — built a plaintext metrics feed but declared + `Content-Type: text/html`, so a queue name containing markup + executed on that endpoint + + Queue names are not validated, so enqueueing to a crafted queue name + is enough: + + ```ruby + Resque.push(%q{">}, 'class' => 'Job', 'args' => []) + ``` + + That payload executes immediately on /queues, /stats/keys, and + /stats.txt. It also reaches /workers and /working once a worker is + registered on that queue, and /failed once a job fails on it. + + ### Patches + + v3.0.2 + + ### Workarounds + + Restrict who can enqueue jobs and which queue names they can enqueue + to, and restrict write access to the Redis instance backing Resque. + Access to `/stats/keys` and `/stats.txt` can be blocked at the proxy + as a partial mitigation. + + ### References + + https://github.com/resque/resque/pull/1946 +cvss_v4: 5.1 +patched_versions: + - ">= 3.0.2" +related: + url: + - https://github.com/resque/resque/security/advisories/GHSA-r23w-h6cg-h95q + - https://github.com/resque/resque/pull/1946 +notes: | + - A CVE has been requested for this GHSA and can be added once assigned. diff --git a/gems/resque/GHSA-r5h4-xh93-f339.yml b/gems/resque/GHSA-r5h4-xh93-f339.yml new file mode 100644 index 0000000000..3fb995e23f --- /dev/null +++ b/gems/resque/GHSA-r5h4-xh93-f339.yml @@ -0,0 +1,93 @@ +--- +gem: resque +ghsa: r5h4-xh93-f339 +url: https://github.com/resque/resque/security/advisories/GHSA-r5h4-xh93-f339 +title: CSRF in resque-web +date: 2026-10-16 +description: | + ### Summary + + resque-web (`Resque::Server`) does not verify that state-changing + requests come from its own origin. If an authenticated resque-web + user visits a malicious page, that page can make the user's browser + clear failed jobs, retry or remove failed jobs, or delete whole + queues. + + ### Details + + Sinatra enables rack-protection by default, but its default reaction + to a bad `Origin` is to drop the Rack session and let the request + through. resque-web doesn't keep its login in a Sinatra session, so + that reaction protects nothing. + + Which setups are exposed depends on how resque-web is authenticated: + + - **HTTP basic auth** (`Resque::Server.use Rack::Auth::Basic`, as the + README recommends): browsers resend cached credentials on + cross-site requests, so every action below is exposed. + - **Host app session cookie with `SameSite=Lax`** (the Rails + default): cross-site POSTs are blocked by the browser, but the GET + actions below are still exposed. + - **Cookies with `SameSite=None` or no SameSite attribute**: every + action is exposed. + + State-changing POST routes: + + - `/queues/:id/remove`, `/queues/:id/remove-job` + - `/failed/clear`, `/failed/clear_retried`, `/failed/:queue/clear` + - `/failed/requeue/all`, `/failed/:queue/requeue/all` + + State-changing GET routes (an `` tag is enough to trigger these): + + - `/failed/requeue/:index`, `/failed/:queue/requeue/:index` + - `/failed/remove/:index`, `/failed/:queue/remove/:index` + + Plugins that add routes to `Resque::Server` (for example + resque-scheduler, resque-cleaner, resque-retry and resque-status) + inherit the same exposure on their POST routes. + + ### Impact + + An attacker who can get a resque-web user to visit a page can change + queue state with that user's access: they can delete pending jobs, + wipe the failed job history, or requeue failed jobs. Requeued jobs + run again, which matters when a job has side effects (charging a + card, sending email). The attacker cannot read anything; this is an + integrity issue, not a disclosure. + + ### Patches + + 3.2.0 rejects any non-GET/HEAD request whose `Sec-Fetch-Site` header + is not `same-origin` or `none`. For browsers that don't send + `Sec-Fetch-Site`, it falls back to rejecting a request whose `Origin` + host doesn't match the request host. Requests that send neither + header (scripts, curl) are unaffected. The single-job retry and + remove actions are now POST-only. The check runs on `Resque::Server` + itself, so it also covers plugin routes. + + ### Workarounds + + Upgrade. If you can't upgrade yet, add this filter to your app before + it serves resque-web. It only covers browsers that send + `Sec-Fetch-Site`, which all current browsers do: + + ```ruby + Resque::Server.before do + site = request.env['HTTP_SEC_FETCH_SITE'] + mutating = !request.safe? || request.path_info.match?(%r{\A/failed/(.+/)?(requeue|remove)/\d+/?\z}) + halt 403 if mutating && site && !%w[same-origin none].include?(site) + end + ``` + + ### References + + https://github.com/resque/resque/pull/1980 +cvss_v4: 6.9 +patched_versions: + - ">= 3.2.0" +related: + url: + - https://github.com/resque/resque/security/advisories/GHSA-r5h4-xh93-f339 + - https://github.com/resque/resque/pull/1980 +notes: | + - A CVE has been requested for this GHSA and can be added once assigned.