CVE-2021-43840 Path traversal in message_bus
Attackers can read secret files via path traversal if diagnostics are enabled, requiring upgrade or disabling diagnostics.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43840?
CVE-2021-43840 is a medium-severity path traversal vulnerability in discourse message_bus, published on 17 Dec 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. This issue has been patched in version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.
Weakness: CWE-22
Which versions are affected by CVE-2021-43840?
2 open source packages ship an affected version, including message_bus. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
message_bus RubyGems | All versions | 3.3.7 |
message_bus RubyGems | All versions | 3.3.7 |
Products include Discourse Message Bus.
How do I fix CVE-2021-43840?
Upgrade message_bus to 3.3.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-43840 being exploited?
There is no known exploitation of CVE-2021-43840 in the wild and no public exploit code.
Sources
Also known as GHSA-xmgj-5fh3-xjmm.