CVE-2026-25136
📋 TL;DR
This is a reflected Cross-site Scripting (XSS) vulnerability in Rucio's WebUI that allows attackers to steal login session tokens. Attackers can craft malicious URLs that, when visited by users, execute JavaScript in the context of the Rucio application. This affects Rucio users running vulnerable versions prior to 35.8.3, 38.5.4, or 39.3.1.
💻 Affected Systems
- Rucio
📦 What is this software?
Rucio by Cern
Rucio by Cern
Rucio by Cern
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrative session tokens, gaining full control over the Rucio instance and potentially accessing sensitive scientific data.
Likely Case
Attackers steal user session tokens to impersonate legitimate users, potentially accessing their data and performing unauthorized actions.
If Mitigated
With proper input validation and output encoding, the XSS payloads are neutralized before reaching users.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly exploited. The attack requires user interaction (clicking a malicious link) but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 35.8.3, 38.5.4, or 39.3.1
Vendor Advisory: https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q
Restart Required: Yes
Instructions:
1. Identify your Rucio version. 2. Upgrade to 35.8.3, 38.5.4, or 39.3.1 depending on your branch. 3. Restart the Rucio services. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to block malicious payloads.
Content Security Policy (CSP)
allImplement a strict CSP header to prevent execution of inline JavaScript.
🧯 If You Can't Patch
- Disable Rucio WebUI if not required
- Implement network segmentation to restrict access to Rucio WebUI
🔍 How to Verify
Check if Vulnerable:
Check Rucio version against affected versions. Test by attempting to inject JavaScript in ExceptionMessage parameters.Check Version:
rucio --versionVerify Fix Applied:
After patching, verify version is 35.8.3, 38.5.4, or 39.3.1. Test XSS payloads to confirm they are properly encoded.📡 Detection & Monitoring
Log Indicators:
- Unusual 500 error requests with JavaScript payloads in parameters
- Multiple failed login attempts followed by successful logins from different IPs
Network Indicators:
- HTTP requests containing JavaScript in query parameters to Rucio WebUI
- Unusual outbound connections after visiting Rucio URLs
SIEM Query:
source="rucio_webui" AND (status=500 AND (request_uri LIKE "%<script%" OR request_uri LIKE "%javascript:%"))🔗 References
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- https://github.com/rucio/rucio/releases/tag/35.8.3
- https://github.com/rucio/rucio/releases/tag/38.5.4
- https://github.com/rucio/rucio/releases/tag/39.3.1
- https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q
