CVE-2024-32657

4.6 · MEDIUM

Published Apr 22, 2024 nixos CWE-79 EPSS 0.46% (38th pctl) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Overview

CVE-2024-32657 is a medium-severity vulnerability affecting nixos hydra. It was published on April 22, 2024 and has a CVSS 3.1 base score of 4.6 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 4.6, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.

Remediation

Check the references section for vendor advisories and patches from nixos. Update hydra to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
nixos	hydra	>= 0, < 23.11	Affected

References

GitHub github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3 GitHub github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx GitHub github.com/NixOS/nixpkgs/pull/306017 GitHub github.com/NixOS/nixpkgs/pull/306018 GitHub github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3 GitHub github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx GitHub github.com/NixOS/nixpkgs/pull/306017 GitHub github.com/NixOS/nixpkgs/pull/306018

Frequently Asked Questions

What is CVE-2024-32657?

CVE-2024-32657 is a medium-severity vulnerability affecting nixos hydra. It was published on April 22, 2024 and has a CVSS 3.1 base score of 4.6 (MEDIUM).

How severe is CVE-2024-32657?

This vulnerability has a CVSS 3.1 base score of 4.6, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-32657?

How can CyberStrike help with CVE-2024-32657?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-32657 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719