CVE-2023-28112
Discourse's SSRF protection missing for some FastImage requests
Severity Score
8.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta` branches versions 3.1.0.beta2 and prior. This issue is patched in version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-03-10 CVE Reserved
- 2023-03-17 CVE Published
- 2024-08-02 CVE Updated
- 2024-10-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/discourse/discourse/commit/39c2f63b35d90ebaf67b9604cf1d424e5984203c | 2023-03-23 | |
| https://github.com/discourse/discourse/pull/20710 | 2023-03-23 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-9897-x229-55gh | 2023-03-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | < 3.1.0 Search vendor "Discourse" for product "Discourse" and version " < 3.1.0" | beta |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | <= 3.1.0 Search vendor "Discourse" for product "Discourse" and version " <= 3.1.0" | stable |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 3.1.0 Search vendor "Discourse" for product "Discourse" and version "3.1.0" | beta1, beta |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 3.1.0 Search vendor "Discourse" for product "Discourse" and version "3.1.0" | beta2, beta |
Affected
| ||||||