Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-32657

Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 4.6, indicating it can be exploited remotely over the network with relatively low complexity though user interaction is required requiring only low-level privileges . The vulnerability impacts limited data confidentiality, limited integrity, for affected systems. Impacting 1 product from nixos organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2024, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2024-04-22T23:15:50.997

Last Modified

2025-09-22T14:10:00.387

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.6 (MEDIUM)

Weaknesses

Type: Secondary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nixos	hydra	< 23.11	Yes

References

https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3 Patch ([email protected])
https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx Vendor Advisory ([email protected])
https://github.com/NixOS/nixpkgs/pull/306017 Issue Tracking ([email protected])
https://github.com/NixOS/nixpkgs/pull/306018 Issue Tracking ([email protected])
https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/NixOS/nixpkgs/pull/306017 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/NixOS/nixpkgs/pull/306018 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For nixos's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.