Vulnerability · Published Sep 29, 2022 · Assigned by GitHub_M

CVE-2022-36066Discourse vulnerable to RCE via admins uploading maliciously zipped file

Critical 9.1

In plain English

A critical-severity unrestricted file upload in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.1%top 18.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	< 2.8.9>= 2.9.0.beta0, < 2.9.0.beta10

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmv x_refsource_CONFIRM
https://github.com/discourse/discourse/pull/18421 x_refsource_MISC
https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835 x_refsource_MISC