CVE-2021-41163

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.

Discourse es una plataforma de código abierto para el debate comunitario. En las versiones afectadas, las peticiones diseñadas de forma maliciosa podían conllevar a una ejecución de código remota . Esto se debía a una falta de comprobación en los valores de subscribe_url. Este problema está parcheado en las últimas versiones estables, beta y de prueba de Discourse. Para solucionar el problema sin necesidad de actualizar, las peticiones con una ruta que empiece por /webhooks/aws podrían bloquearse en un proxy de subida