Resque vulnerable to reflected XSS in Queue Endpoint

Root

Cause Resque, a Redis-backed Ruby library for background jobs, suffers from a reflected cross-site scripting (XSS) vulnerability in its web frontend. The /queues endpoint does not properly sanitize user-supplied input, allowing an attacker to inject arbitrary HTML and JavaScript by appending a malicious query string to the URL [1][2][3]. The official advisory demonstrates that appending /"><svg%20onload=alert(domain)> triggers script execution in the victim's browser [3].

Attack

Vector An attacker can exploit this issue by crafting a specially formed URL and enticing a user to click on it (e.g., via phishing, social media, or a malicious link). No authentication or special network position is required beyond network access to the Resque web interface. The attack is fully reflected: the malicious payload is part of the request and is echoed back in the response without proper encoding [2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Resque web interface. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Since Resque is commonly used for monitoring background jobs in development and production environments, the impact may be elevated if the web UI is exposed to untrusted users.

Remediation

The vulnerability has been patched in Resque version 2.6.0 [3]. Users are strongly advised to upgrade to this version or later. If immediate upgrade is not possible, restricting access to the Resque web interface (e.g., firewalls, VPN, or authentication proxies) can reduce the attack surface [1][4]. The vendor also maintains a separate Ruby advisory database entry tracking this CVE [4].