https://discourse-mediawiki.wmflabs.org is an abandoned read-only mode Discourse instance (means: log in and sign up have been disabled since T247010; its shutdown to be sorted out in T262275).
Last time I checked in March 2020, it was running an ancient 2.4.0.beta8 version.
I'm unfortunately not tech-savvy enough and thus clueless if https://nvd.nist.gov/vuln/detail/CVE-2021-41163 / https://0day.click/recipe/discourse-sns-rce/ are relevant (because our instance is just read-only?).
Probably it's not relevant; filing this ticket just to make sure, so feel very welcome to close as invalid.
In case it's vulnerable, easiest mitigation would be to block requests with a path starting with /webhooks/aws.
Description
Description
Details
Details
- Risk Rating
- Low
- Author Affiliation
- WMF Technology Dept
Related Objects
Related Objects
Event Timeline
Comment Actions
I'm not certain if much has changed within a few years, but doing some quick Google research, it doesn't look like there were many great options for archiving a Discourse site as static-ish html, so as to avoid a situation like this where an unmaintained version lives on indefinitely. This thread offers some interesting conversation on the matter and features at least a few proposed workarounds which might make sense to further explore for this case.
Comment Actions
The discourse-mediawiki.wmflabs.org proxy service is pointed at the discourse-mw.discourse.eqiad1.wikimedia.cloud vm in the discourse project.
Listed administrators for the project are: @Aklapper, @Andrew (as a side effect of creating the project?), @Austin, @EBernhardson, @Tgr, @Qgil, and @Samwilson.
Comment Actions
I can update Discourse within a week or two. Not sure if we are affected - we don't use AWS at all, the aws-sdk-sns gem got installed as part of the standard Discourse bundle, though.
Comment Actions
Thanks. I think the Security-Team would consider this low / no risk as you and @Aklapper noted we don't host Discourse at AWS, and this issue does appear to only be a vulnerability if that is case. Still, if something is basically unused at this point, it should be decommissioned. Or in this case, perhaps turned into static archives which present no risk at the application layer.
Comment Actions
@Tgr were you able to update things here? If not, can you do that soon? We're discussing now whether or not to shut this down; would be nice to not have to decide :)
-Andrew
Comment Actions
Updated both sites to current version (2.8.0.beta8).
For context, I don't think discourse-mediawiki has too much value in itself, even as an archive, but there have been conversations about relaunching https://discuss-space.wmflabs.org/ as a community project, and the other Discourse site would then be useful as a test site.