CVE-2017-12097

Vulnerability

The delayed_job_web gem version 1.4 contains a cross-site scripting (XSS) vulnerability in its filter functionality. The filter input is not properly escaped before being rendered in the web interface, allowing an attacker to inject arbitrary HTML/JavaScript via a specially crafted URL. This affects all installations using version 1.4 of the gem [1][2].

Exploitation

An attacker can craft a malicious URL containing JavaScript payloads in the filter parameter and phish an authenticated user into clicking the link. No additional authentication is required beyond the victim's existing session. The attacker does not need any special network position; the attack can be performed remotely via social engineering [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, data theft, or further actions within the delayed_job_web interface. The attacker gains the same privileges as the authenticated user [1][4].

Mitigation

The vulnerability is fixed in delayed_job_web commit 6bcb10e61ea2b9a44ffa16be8536dff46ad51449, which escapes the filter output [2]. Users should upgrade to a version containing this fix or apply the patch manually. No official release with the fix has been identified in the references; the advisory recommends using the patched code [4]. As of the publication date, no workaround other than upgrading is documented.