The United States Cybersecurity and Infrastructure Security Agency (CISA) over the weekend issued an alert on a critical vulnerability in open source discussion platform Discourse.
Residing in the upstream aws-sdk-sns gem, the issue is a validation error that can be exploited to achieve remote code execution in Discourse. To exploit the bug, an attacker would need to send a maliciously crafted request.
Tracked as CVE-2021-41163, the vulnerability has a CVSS score of 10 and exists because of a lack of validation in subscribe_url values.
Both CISA and Discourse, which released a patch for the security flaw last week, refrained from providing technical details on the issue, due to potential exploitation attempts.
The vulnerability was addressed in Discourse versions 2.7.9 (stable) and 2.8.0.beta7 (beta and tests-passed).
“CISA urges developers to update to patched versions 2.7.9 or later or apply the necessary workarounds,” the US agency said on Sunday.
Those who cannot update to a patched version immediately are advised to make sure they block requests with a path starting /webhooks/aws at an upstream proxy, the Discourse team explains.
Discourse is an Internet forum and mailing list management software that also provides long-form chat room, live update, and drag-and-drop attachment functionality, and which can be self-hosted.
Discourse says it serves more than 2,000 customers. BuiltWith statistics show that, while the platform was deployed on over 31,000 websites, only approximately 14,300 of them are currently live. It’s unclear how many of these remain at risk.
Related: New CISA Tool Helps Organizations Assess Insider Threat Risks
Related: CISA Details Additional Malware Targeting Pulse Secure Appliances
Related: CISA Issues Emergency Directive to Address ‘PrintNightmare’ Vulnerability
