CVE-2024-38360: 
NixOS vulnerability analysis and mitigation

Discourse, an open source platform for community discussion, contains a vulnerability (CVE-2024-38360) where moderators can create replacement words with an almost unlimited number of characters, potentially reducing the availability of a Discourse instance. This vulnerability was discovered and disclosed on July 15, 2024, affecting stable versions <= 3.2.2, beta <= 3.3.0.beta2, and tests-passed <= 3.3.0.beta2 (GitHub Advisory).

The vulnerability stems from the watch words controller creation function (create_or_update_word()) not validating the size of the replacement parameter when creating replace watched words, unlike the word parameter. This allows moderators to create watched words with almost unlimited characters, which can impact system availability. The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Moderate) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

The primary impact of this vulnerability is on system availability. By exploiting this vulnerability, a moderator can create replacement words with an excessive number of characters, which can reduce the availability of the Discourse instance (GitHub Advisory).

The vulnerability requires high privileges (moderator access) to exploit. It can be executed remotely through the network with low attack complexity and requires no user interaction (GitHub Advisory).

The vulnerability has been patched in stable version 3.2.3 and current betas. Users are advised to upgrade to these versions. For users unable to upgrade immediately, a workaround is available by manually removing the long watched words either via SQL or Rails console (CISA Bulletin).