# Discourse Vulnerability CVE-2021-41163
**URL:** https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476
**Category:** Self-hosting
**Created:** [October 29, 2021, 12:28am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476 "2021-10-29T00:28:24Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@sarahann](https://meta.discourse.org/u/sarahann)
#### Post date: [October 29, 2021, 12:28am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/1 "2021-10-29T00:28:24Z")
Hey all,
I was recently made aware of this security vulnerability in Discourse [NVD - CVE-2021-41163 (nist.gov)](https://nvd.nist.gov/vuln/detail/CVE-2021-41163#vulnCurrentDescriptionTitle)
I was curious because its on the `/webhooks/aws` url, is Discourse in Azure affected by this as well?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 29, 2021, 4:18am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/2 "2021-10-29T04:18:10Z")
Every instance is affected (if not patched) no matter where you host it.
---
### Author:  [@sarahann](https://meta.discourse.org/u/sarahann)
#### Post date: [October 29, 2021, 6:46pm UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/5 "2021-10-29T18:46:21Z")
Hey @Falco thanks for the speedy reply!
I am not a ruby expert but I thought that [this line of code](https://github.com/discourse/discourse/blob/fa3c46cf079d28b086fe1025349bb00223a5d5e9/app/jobs/regular/confirm_sns_subscription.rb#L14) would prevent the execution of the vulnerable bit on Azure as it would evaluate to false?? Please do correct me here cause I don’t know ruby.
Also, as a complete band-aid solution and NOT RECCOMENDED as upgrading is 100% the best solution. Could you edit the nginx file in order to temporarily fix this until upgrading?
Like this:
1. ssh to machine
2. cd /var/discourse
3. ./launcher enter app
4. cd /etc/nginx/conf.d/
5. edit discourse.conf
6. add:
```plaintext
location ~* /webhooks/aws {
deny all;
}
```
1. sv restart nginx
I have every intention of upgrading, and soon. But I’ll need about a week to organize things for our live environment and would like to be secure in the meantime.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 29, 2021, 7:20pm UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/6 "2021-10-29T19:20:41Z")
> [@sarahann](#):
>
> I am not a ruby expert but I thought that [this line of code](https://github.com/discourse/discourse/blob/fa3c46cf079d28b086fe1025349bb00223a5d5e9/app/jobs/regular/confirm_sns_subscription.rb#L14) would prevent the execution of the vulnerable bit on Azure as it would evaluate to false?? Please do correct me here cause I don’t know ruby.
That line will execute anyway, as that parameter is user input.
> [@sarahann](#):
>
> Also, as a complete band-aid solution and NOT RECCOMENDED as upgrading is 100% the best solution. Could you edit the nginx file in order to temporarily fix this until upgrading?
> Like this:
>
> 1. ssh to machine
> 2. cd /var/discourse
> 3. ./launcher enter app
> 4. cd /etc/nginx/conf.d/
> 5. edit discourse.conf
> 6. add:
>
> ```plaintext
> location ~* /webhooks/aws {
> deny all;
> }
>
> ```
>
> 1. sv restart nginx
That may work, but as you stated is a band-aid. Rebuilding will remove the fix, and be very careful testing as nginx config is very tricky to get right.
---
### Author:  [@awslabspl](https://meta.discourse.org/u/awslabspl)
#### Post date: [October 29, 2021, 9:19pm UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/7 "2021-10-29T21:19:37Z")
> [@sarahann](#):
>
> security vulnerability in Discourse
Based on the insight of our security team, this **is not** Discourse bug. This bug is in our SNS messages distribution system ( MDS ) ( cannot go into much details here ) meaning it will affect **every** package that uses / make use of SNS service.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [October 29, 2021, 9:29pm UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/8 "2021-10-29T21:29:50Z")
Yes, the problem is indeed caused by an upstream issue in the `aws-sdk-sns` gem. But it is important to realize that - since Discourse uses this gem and exposes the bug to the world - every Discourse instance is vulnerable even when it does not actually _use_ the AWS SNS service.
So while it is not a “Discourse bug” it _is_ a “security vulnerability in Discourse”.
---
### Author:  [@valsha](https://meta.discourse.org/u/valsha)
#### Post date: [October 30, 2021, 8:59am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/9 "2021-10-30T08:59:30Z")
is this vulnerability fixed? thank you.
---
### Author:  [@HAWK](https://meta.discourse.org/u/HAWK)
#### Post date: [October 30, 2021, 9:08am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/10 "2021-10-30T09:08:50Z")
Yes, but you need to ensure that you’ve applied the patch. Read the topic. 🙂
---
### Author:  [@valsha](https://meta.discourse.org/u/valsha)
#### Post date: [October 30, 2021, 9:14am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/11 "2021-10-30T09:14:35Z")
a simple
> launcher rebuild app
will not help to fix this vulnerability?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [October 30, 2021, 10:23am UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/12 "2021-10-30T10:23:54Z")
`./launcher rebuild app` will apply the latest updates to your Discourse instance, and will include the patch for this issue 👍
Official information can be found at [RCE via malicious SNS subscription payload · Advisory · discourse/discourse · GitHub](https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-pvpc-qgwq)
---
### Author:  [@awslabspl](https://meta.discourse.org/u/awslabspl)
#### Post date: [October 30, 2021, 6:06pm UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/13 "2021-10-30T18:06:26Z")
> [@michaeld](#):
>
> So while it is not a “Discourse bug” it _is_ a “security vulnerability in Discourse”.
Sounds better 🙂
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [November 29, 2021, 6:06pm UTC](https://meta.discourse.org/t/discourse-vulnerability-cve-2021-41163/207476/14 "2021-11-29T18:06:29Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.