PT-2023-21571 · Discourse · Discourse

Jomaxro · Published 2023-03-17 · Updated 2024-03-06 · CVE-2023-28112

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.0.beta3

Description Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user-provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses.

Recommendations For versions prior to 3.1.0.beta3, update to version 3.1.0.beta3 or later of the beta and tests-passed branches to resolve the issue. As a temporary workaround, consider restricting access to the FastImage functionality until a patch is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-DISCOURSE-2023-28112

CVE-2023-28112

GHSA-9897-X229-55GH

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28112.json · Exploit
• https://github.com/discourse/discourse/commit/39c2f63b35d90ebaf67b9604cf1d424e5984203c · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-9897-x229-55gh · Vendor Advisory
• https://github.com/discourse/discourse/pull/20710 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28112 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2023-28112 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28112 · Vendor Advisory
• https://t.me/cibsecurity/60267 · Telegram Post