Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

CISA Urges Admins To Patch Critical Discourse Code Execution Bug

CISA Urges Admins To Patch Critical Discourse Code Execution Bug

A critical Discourse remote code execution (RCE) vulnerability tracked as CVE-2021-41163 was fixed via an urgent update by the developer on Friday

Discourse is an open-source forum, long-form chat, and mailing list management platform widely deployed on the web, offering excellent usability and integration potential while focusing heavily on social features. 

The vulnerable versions are 2.7.8 and older, and the best way to address the risk is to update to 2.7.9 or later, which came out on Friday. The latest beta and test versions have also been patched against the flaw. 

Also Read: October 2021 PDPC Incidents and Undertaking: Lessons from the Cases

According to official stats, Discourse was used to publish 3.5 million posts viewed by 405 million users in September 2021 alone.

Because of Discourse’s widespread use, CISA also published an alert about the flaw, urging forum admins to update to the latest available version or apply the necessary workarounds. 

The exploit is triggered by sending a maliciously crafted request to the vulnerable software, taking advantage of a lack of validation in the ‘subscribe-url’ values. 

Calls to `open()` with user supplied input allows to invoke OS commands with whatever rights the web app runs on, which is typically ‘www-data’ (admin). 

The implications of a CVE-2021-41163 exploit and the ease of leveraging it (sending an unauthenticated POST) result in a CVSS v3 score of 10.0 (critical), so patching it should be treated as an emergency.

A Shodan search has returned 8,641 Discourse deployments, many of which could still be exposed to RCE exploitation potential. However, all SaaS instances have been patched since Wednesday.

Discourse deployments
Discourse deployments

Anyone who can’t update to the latest version is advised to block requests with a path starting with ‘/webhooks/aws’ at an upstream proxy. 

Also Read: How often should you pen test?

At this time, the flaw is still undergoing technical analysis, but the researcher who discovered it has published rich technical details about it.  

Publishing too many details about the flaw only a few days after a fix has been made available would only give pointers to hackers on how to exploit it. Still, the researcher told us the patch itself made deductions easy anyway. 

The researcher who discovered the flaw told BleepingComputer that he reported the problem to the Discourse team immediately, on October 10, 2021.

We have reached out to Discourse to find out if they have seen any evidence of exploitation of CVE-2021-41163 in the wild, and we will update this post as soon as we hear back from them.. 



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us