Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Hydra has persistent XSS vulnerability serving HTML build outputs

CVE-2024-32657 · published 2 years ago
Summary

Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving...

What to do
  • Update nixos hydra to version 23.11 or later.
Affected software
VendorProductAffected versions
nixos hydra < 23.11
cpe:2.3:a:nixos:hydra:*:*:*:*:*:*:*:*
Original advisory text
Hydra has persistent XSS vulnerability serving HTML build outputs
Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published22 Apr 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-32657 · NVD
CVE-2024-32657 · OSV
GHSA-2p75-6g9f-pqgx · GHSA
Track software like this
Free during beta