by Kastro
Paper/Archive/CVE-2021-41163

CVE-2021-41163

discourse discourse — RCE via malicious SNS subscription payload

EPSS 20%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 97.4.974 × 2019.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.

Affected

ProductAffectedFixed inSource
discoursetests-passed < 2.8.0.beta7–CNA
discoursebeta < 2.8.0.beta7–CNA
discoursestable < 2.7.9–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/discourse/discourse/security/advisories/GHSA-jcjx-pvpc-qgwqrefgithub.com/discourse/discourse/commit/fa3c46cf079d28b086fe1025349bb00223a5d5e9