#!/usr/bin/env bash # ----------------------------------------------------------------------------- # .SYNOPSIS # Audits for CVE-2025-68933 by detecting the installed Discourse version # (Docker-first) and comparing it to patched thresholds. # # .DESCRIPTION # This script performs a high-precision audit for CVE-2025-68933 (Discourse # broken access control involving post ownership transfer and user archive export). # # Detection approach: # - Prefer Docker: locate a likely Discourse container and read /var/www/discourse/VERSION # (or fallback to rails runner to print version). # - Compare detected version against patched floors: # * 3.5.4 # * 2025.11.2 # * 2025.12.1 # * 2026.1.0 # - Best-effort: also read SiteSetting.moderators_change_post_ownership to refine exposure. # # REQUIREMENTS: # - Bash: 4+ # - OS: Linux # - Tools: docker (recommended), coreutils # WARNINGS: # - Requires root privileges (or docker group access); this script enforces root. # - If version cannot be determined, script reports VULNERABLE=TRUE (conservative). # # .NOTES # VERSION: 1.0 # CHANGELOG: # - 1.0 (2026-02-20): Initial release. # # DISCLAIMER: # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # .AUTHOR # This script has been made by Vicarius Research Team # # .VERSION # 1.0 # ----------------------------------------------------------------------------- set -Eeuo pipefail CVE_ID="CVE-2025-68933" PREFERRED_CONTAINER_NAMES=("app" "web_only" "discourse" "discourse-app") write_status() { local msg="$1" local level="$2" local tag case "$level" in Info) tag="[Info]" ;; Success) tag="[Success]" ;; Warning) tag="[Warning]" ;; Skip) tag="[Skip]" ;; Error) tag="[Error]" ;; *) tag="[Info]" ;; esac echo "${tag} ${msg}" } # Admin check if [[ "${EUID}" -ne 0 ]]; then write_status "Administrator privileges required." "Error" echo "RESULT=${CVE_ID}|VULNERABLE|TRUE" exit 1 fi die_audit() { local reason="$1" write_status "$reason" "Error" # Conservative: if we cannot determine, assume vulnerable echo "RESULT=${CVE_ID}|VULNERABLE|TRUE" exit 1 } on_err() { local line="${1:-unknown}" write_status "Unhandled error at line ${line}. Treating as VULNERABLE (conservative)." "Error" echo "RESULT=${CVE_ID}|VULNERABLE|TRUE" exit 1 } trap 'on_err $LINENO' ERR command_exists() { command -v "$1" >/dev/null 2>&1; } find_discord_container() { # Returns a container name or empty string. local c # 1) Prefer known names if running for c in "${PREFERRED_CONTAINER_NAMES[@]}"; do if docker ps --format '{{.Names}}' | grep -Fxq "$c"; then echo "$c" return 0 fi done # 2) Otherwise choose first container whose image contains "discourse" c="$(docker ps --format '{{.Names}}|{{.Image}}' | awk -F'|' 'tolower($2) ~ /discourse/ {print $1; exit}')" echo "${c:-}" } get_version_from_container() { local container="$1" local ver="" # Try VERSION file first ver="$(docker exec "$container" sh -lc 'cat /var/www/discourse/VERSION 2>/dev/null || cat /var/www/discourse/version 2>/dev/null || true' | tr -d '\r' | head -n1 || true)" if [[ -n "$ver" ]]; then echo "$ver" return 0 fi # Fallback: rails runner ver="$(docker exec "$container" sh -lc 'cd /var/www/discourse 2>/dev/null && RAILS_ENV=production bundle exec rails runner "puts Discourse::VERSION::STRING" 2>/dev/null || true' | tr -d '\r' | head -n1 || true)" echo "${ver:-}" } get_setting_from_container() { local container="$1" local val="" val="$(docker exec "$container" sh -lc 'cd /var/www/discourse 2>/dev/null && RAILS_ENV=production bundle exec rails runner "puts SiteSetting.moderators_change_post_ownership" 2>/dev/null || true' | tr -d '\r' | head -n1 || true)" case "$val" in true|false) echo "$val" ;; *) echo "" ;; esac } # Parse "v3.5.3" / "3.5.3" / "2025.11.2-beta" -> major minor patch parse_semver() { local raw="$1" local clean clean="$(echo "$raw" | sed -E 's/^[^0-9]*//; s/[^0-9.].*$//')" # Must have at least X.Y ; patch optional -> default 0 if ! echo "$clean" | grep -Eq '^[0-9]+\.[0-9]+(\.[0-9]+)?$'; then return 1 fi local major minor patch major="$(echo "$clean" | cut -d. -f1)" minor="$(echo "$clean" | cut -d. -f2)" patch="$(echo "$clean" | cut -d. -f3 2>/dev/null || true)" patch="${patch:-0}" echo "${major} ${minor} ${patch}" } # Compare semver tuples: returns 0 if A>=B, 1 if A b_major )); then return 0; fi if (( a_major < b_major )); then return 1; fi if (( a_minor > b_minor )); then return 0; fi if (( a_minor < b_minor )); then return 1; fi if (( a_patch >= b_patch )); then return 0; fi return 1 } patched_floor_for() { # Given detected major/minor/patch, emit floor major minor patch local major="$1" minor="$2" patch="$3" # Stable line if (( major < 2000 )); then echo "3 5 4" return 0 fi # 2025 line if (( major == 2025 )); then if (( minor <= 11 )); then echo "2025 11 2" return 0 fi if (( minor == 12 )); then echo "2025 12 1" return 0 fi # Later than 2025.12 -> assume floor at 2025.12.1 echo "2025 12 1" return 0 fi # 2026 line if (( major == 2026 )); then if (( minor <= 1 )); then echo "2026 1 0" return 0 fi echo "2026 1 0" return 0 fi # Newer year -> assume fix landed at least by 2026.1.0 baseline echo "2026 1 0" } write_status "Starting audit for ${CVE_ID} ..." "Info" if ! command_exists docker; then write_status "Docker not found. Unable to reliably detect Discourse version. Treating as VULNERABLE (conservative)." "Warning" echo "RESULT=${CVE_ID}|VULNERABLE|TRUE" exit 0 fi container="$(find_discord_container)" if [[ -z "$container" ]]; then write_status "No likely Discourse container detected. Treating as VULNERABLE (conservative)." "Warning" echo "RESULT=${CVE_ID}|VULNERABLE|TRUE" exit 0 fi write_status "Using container '${container}'" "Info" version_raw="$(get_version_from_container "$container")" if [[ -z "$version_raw" ]]; then die_audit "Unable to read Discourse version from container." fi write_status "Detected Discourse version string: '${version_raw}'" "Info" if ! read -r det_major det_minor det_patch < <(parse_semver "$version_raw"); then die_audit "Unable to parse semantic version from '${version_raw}'." fi read -r floor_major floor_minor floor_patch < <(patched_floor_for "$det_major" "$det_minor" "$det_patch") write_status "Patched floor for this release train: ${floor_major}.${floor_minor}.${floor_patch}" "Info" vulnerable="FALSE" # Optional refinement with the risky setting setting="$(get_setting_from_container "$container")" if [[ -n "$setting" ]]; then write_status "SiteSetting moderators_change_post_ownership = ${setting}" "Info" if [[ "$setting" == "false" ]]; then write_status "Setting is disabled; exploit chain is mitigated at configuration level. Patch still recommended." "Success" vulnerable="FALSE" else if semver_ge "$det_major" "$det_minor" "$det_patch" "$floor_major" "$floor_minor" "$floor_patch"; then vulnerable="FALSE" else vulnerable="TRUE" fi fi else write_status "Could not determine SiteSetting 'moderators_change_post_ownership' (best-effort). Using version-only decision." "Warning" if semver_ge "$det_major" "$det_minor" "$det_patch" "$floor_major" "$floor_minor" "$floor_patch"; then vulnerable="FALSE" else vulnerable="TRUE" fi fi if [[ "$vulnerable" == "TRUE" ]]; then write_status "System appears VULNERABLE to ${CVE_ID} (unpatched Discourse for this release train and/or exposure setting enabled)." "Error" else write_status "System appears NOT vulnerable to ${CVE_ID} (patched or configuration mitigated)." "Success" fi echo "RESULT=${CVE_ID}|VULNERABLE|${vulnerable}"

Description