The United States Cybersecurity and Infrastructure Security Agency (CISA) over the weekend issued an alert on a critical vulnerability in open source discussion platform Discourse.
Residing in the upstream aws-sdk-sns gem, the issue is a validation error that can be exploited to achieve remote code execution in Discourse. To exploit the bug, an attacker would need to send a maliciously crafted request.
Tracked as CVE-2021-41163, the vulnerability has a CVSS score of 10 and exists because of a lack of validation in subscribe_url values.
Both CISA and Discourse, which released a patch for the security flaw last week, refrained from providing technical details on the issue, due to potential exploitation attempts.
The vulnerability was addressed in Discourse versions 2.7.9 (stable) and 2.8.0.beta7 (beta and tests-passed).
“CISA urges developers to update to patched versions 2.7.9 or later or apply the necessary workarounds,” the US agency said on Sunday.
Those who cannot update to a patched version immediately are advised to make sure they block requests with a path starting /webhooks/aws at an upstream proxy, the Discourse team explains.
Discourse is an Internet forum and mailing list management software that also provides long-form chat room, live update, and drag-and-drop attachment functionality, and which can be self-hosted.
Discourse says it serves more than 2,000 customers. BuiltWith statistics show that, while the platform was deployed on over 31,000 websites, only approximately 14,300 of them are currently live. It’s unclear how many of these remain at risk.
Related: New CISA Tool Helps Organizations Assess Insider Threat Risks
Related: CISA Details Additional Malware Targeting Pulse Secure Appliances
Related: CISA Issues Emergency Directive to Address ‘PrintNightmare’ Vulnerability
More from Ionut Arghire
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- Latitude Financial Services Data Breach Impacts 300,000 Customers
- US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
- New ‘Trigona’ Ransomware Targets US, Europe, Australia
- New Espionage Group ‘YoroTrooper’ Targeting Entities in European, CIS Countries
- CISA Seeks Public Opinion on Cloud Application Security Guidance
Latest News
- Ferrari Says Ransomware Attack Exposed Customer Data
- Aembit Scores $16.6M Seed Funding for Workload IAM Technology
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- New York Man Arrested for Running BreachForums Cybercrime Website
