Sidekiq-cron EUVD-2025-209725

Exploitation requires that a victim user is authenticated to the Sidekiq web UI and can be induced to click or be redirected to an attacker-crafted URL targeting the cron.erb endpoint. No special server-side configuration is required beyond the presence of sidekiq-cron v2.3.1 or earlier with the web UI enabled. Exploitation is constrained by mandatory user interaction (UI:R per CVSS) - the attack cannot be triggered server-side without the victim actively navigating to the malicious URL. Additional limiting factors include: the Sidekiq web UI is typically deployed on internal networks or behind authentication middleware, restricting the attacker's delivery surface; the SSVC confirms the attack is not automatable, ruling out mass scanning or drive-by exploitation without targeted social engineering.

CVSS 6.1 (Medium) accurately reflects the limited direct server-side impact; the scope change to S:C elevates the score above a typical non-scoped XSS. EPSS is 0.01% at the 0th percentile, indicating the broader security community currently assesses exploitation as extremely unlikely relative to the full CVE universe. SSVC classifies exploitation status as POC (a proof-of-concept exists), but also marks the attack as not automatable and technical impact as partial - consistent with reflected XSS requiring victim interaction and delivering only partial credential/session exposure rather than full system compromise. The vulnerability is not in CISA KEV, so no confirmed active exploitation has been observed. Real-world risk is further bounded by deployment context: Sidekiq web UIs are typically protected by authentication middleware and restricted to internal networks or VPNs in production environments, which limits attacker delivery surface. For organizations with publicly exposed or loosely protected Sidekiq UIs, risk is meaningfully higher. There is no conflict between data sources; the signals are consistent and coherent.

An attacker identifies an organization running Sidekiq-cron v2.3.1 or earlier with the web UI accessible externally or reachable to targeted internal users. They craft a URL embedding a JavaScript payload in a parameter reflected by cron.erb and deliver it via phishing email to a Sidekiq administrator. When the administrator clicks the link while authenticated, the payload executes in their browser, potentially exfiltrating the session cookie or performing administrative job management actions on their behalf. A POC is known to exist per SSVC, reducing the skill threshold for exploitation.