Discourse 2.8.0.beta6 < 2.9.0.beta5 XSS Vulnerability

# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:discourse:discourse";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.117702");
  script_version("2025-04-11T15:45:04+0000");
  script_tag(name:"last_modification", value:"2025-04-11 15:45:04 +0000 (Fri, 11 Apr 2025)");
  script_tag(name:"creation_date", value:"2021-09-28 09:31:29 +0000 (Tue, 28 Sep 2021)");
  script_tag(name:"cvss_base", value:"4.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-10-06 15:49:00 +0000 (Wed, 06 Oct 2021)");

  script_cve_id("CVE-2021-41095");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Discourse 2.8.0.beta6 < 2.9.0.beta5 XSS Vulnerability");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_discourse_http_detect.nasl");
  script_mandatory_keys("discourse/detected");

  script_tag(name:"summary", value:"Discourse is prone to a cross-site scripting (XSS)
  vulnerability.");

  script_tag(name:"insight", value:"Rendering of some error messages that contain user input can be
  susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words
  that contain HTML tags, modified or disabled Discourse's default Content Security Policy.");

  script_tag(name:"affected", value:"Discourse version 2.8.0.beta1 through 2.8.0.beta6.

  This vulnerability only affects sites which have modified or disabled Discourse's default Content
  Security Policy, and have blocked watched words containing HTML tags.");

  script_tag(name:"solution", value:"Update to version 2.9.0.beta5 or later.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_xref(name:"URL", value:"https://github.com/discourse/discourse/security/advisories/GHSA-qvqx-2h7w-m479");
  script_xref(name:"URL", value:"https://github.com/discourse/discourse/pull/14434");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "2.8.0.beta1", test_version2: "2.8.0.beta6")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "2.9.0.beta5", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);