Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2021-41163

Description

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.

POC

Reference

No PoCs from references.

Github

- https://github.com/ibrahmsql/CVE-2021-41163

- https://github.com/ibrahmsql/discourse-CVE-2021-41163

- https://github.com/ibrahmsql/discoursemap

- https://github.com/malwaremily/infosec-news-briefs