Discourse: Stored XSS in posts because of absence of oembed variables values escaping

Hello! Steps to reproduce: 1. Paste this payload URL in the post: http://89.223.28.48/oembedvideo.html?uncache 2. Save the post and you will see the XSS will fire. F151922 The vulnerability exists because of absence of oembed variables values escaping. There is the oembed link in the payload page...

Discourse: Stored XSS in topics because of whitelisted_generic engine vulnerability

Hello! Steps to reproduce: 1. Paste this payload URL in the topic: http://89.223.28.48/ogimage.html?uncache1234 2. Save the post and you will see the XSS will fire F151911 Though you now escape the OpenGraph data, the whitelistedgeneric onebox engine decodes variables values back at lines: 202 an...

Discourse: XSS in topics because of bandcamp preview engine vulnerability

Load http://try.discourse.org 2. Click "New topic" 3. Enter this payload https://89.223.28.48/bandcamp.com/album/index.html?XSSa2 to field with placeholder "Type title or paste a link here" 4. Wait for the preview engine to parse the link 4. XSS will fire F151439 You should sanitize external...

Discourse: XSS vulnerability on Audio and Video parsers

Just like in the XSS vulnerability on Image parser, there is the same vulnerability on Audio https://github.com/discourse/onebox/blob/394409ca319cc1a1cd31fefa50c9468c990531a3/lib/onebox/engine/audioonebox.rb and Video...

Discourse: XSS Vulnerability on Image link parser

I found a XSS Cross-Site Scripting vulnerability, and it is present in the markdown parser when it tries to parse an image URL. To reproduce the vulnerability you need to add a fake image url like: http://host/path/to/image'onerror=alert1;//.png As you can see, we have an invalid image URL which...

Discourse: DOM Based XSS in Discourse Search

Steps to Reproduce: 1. Load http://try.discourse.org 2.Now From Top Right Corner Click on Search Button 3. Enter payload their Payload: @prompt1337gmail.com 4: Now in new windows that opens click on advance search and The XSS will Occur : 5: Now copy the link and send to victim there the XSS will...