Discourse vulnerable to Cross-site Scripting in local oneboxes

CVE-2023-22468

Summary

Discourse is an open-source community discussion platform that is vulnerable to cross-site scripting (XSS) attacks in specific versions. Attackers can exploit this vulnerability by embedding malicious URLs in posts, leading to the potential execution of harmful scripts on user browsers. Such attacks can succeed on sites with disabled or overly permissive Content Security Policies (CSP). It is important to note that the default CSP in Discourse mitigates this vulnerability. Users are encouraged to upgrade to patched versions 2.8.13 (stable) or 3.0.0.beta16 (beta) to enhance security. Alternatively, restoring the original CSP settings can serve as a temporary mitigation strategy.

References