Discourse < 2.2.0.beta5 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; if...

Discourse < 2.2.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; if...

Security Risks of Chatbots

Good essay on the security risks -- to democratic discourse -- of chatbots...

Discourse: Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo account

Hi There is an option in https://try.discourse.org/u/testh1ay/preferences/account to connect our Yahoo account. I noticed Connect Yahoo account option have the workflow with GET method and there is lack of csrf protection on connecting yahoo account which can help attacker into inducing victim to...

Discourse < 2.1.0.beta5 XSS Vulnerability

Discourse is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

Discourse: Web Cache Deception Attack (XSS)

This XSS does not affect the try.discourse.org, but worked on many other Discourse instances, that i tested. In discussions with the Mozilla team, we came to the conclusion that this is a vulnerability in the Discourse and it needs to be sent through this program. List of vulnerable hosts:...

Discourse < 2.0.0 beta6 Stored XSS Vulnerability

Discourse is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Discourse Detection (HTTP)

HTTP based detection of Discourse. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.108454";...

Discourse: Gaining access to private topics using quoting feature

Description Some topics have limited access to certain groups and users, and while there exists a validation for access on this topic, it can be bypassed by abusing a vulnerability in the "onebox" quoting feature. When pasting a link in a reply, if this link happens to be a link to another topic ...

discourse.10colorstenkara.com XSS vulnerability

Vulnerable URL: https://discourse.10colorstenkara.com/email/[email protected]%27%22%3E%3Csvg/onload=alert/openbugbounty/%3E Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 10:20 GMT Vulnerability type:| XSS Vulnerability status...

Roblox: Subdomain Takeover at creatorforum.roblox.com

Hello. A few days ago, I was looking at Roblox subdomains, and I noticed an unusual one called creatorforum.roblox.com. Upon further investigation, I visited it and saw that creatorforum.roblox.com's CNAME was a nonexistant Discourse website. I immediately reported to [email protected], and...

Discourse: CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)

Hi, I noticed this issue on one of your clients which was using CloudFlare in front of their Discourse. This is not affecting try.discourse.org but the same underlying issue can be seen there as well even though it's not exploitable on that specific domain. The TL;DR of issue is basically:...

Discourse - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Discourse published at the 'play' market has multiple vulnerabilities...

Discourse: Any user with invite capabilities can take-over any account on Discourse

Description Users with a trust level of 2 and above on Discourse being a member for 15 days,reading more than 100 posts and more - can be seen on: https://github.com/discourse/discourse/blob/b7386958edfb8215c99d90fde04521b3312d2ccd/config/sitesettings.yml can invite new users to join discourse by...

WebKit JSC arrayProtoFuncSplice Initialization Fail

WebKit: JSC: arrayProtoFuncSplice doesn't initialize all indices. CVE-2017-6980 Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

Discourse: Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks

As an Admin user on Discourse there is a feature to create, upload, and restore backups. Generating a backup creates a tar file consisting of the database as a SQL file and uploaded files from /public/upload/. Having the ability to upload these tar files and restore from them, you can add any fil...

Discourse: Stored XSS in posts because of absence of oembed variables values escaping

Hello! Steps to reproduce: 1. Paste this payload URL in the post: http://89.223.28.48/oembedvideo.html?uncache 2. Save the post and you will see the XSS will fire. F151922 The vulnerability exists because of absence of oembed variables values escaping. There is the oembed link in the payload page...

Discourse: Stored XSS in topics because of whitelisted_generic engine vulnerability

Hello! Steps to reproduce: 1. Paste this payload URL in the topic: http://89.223.28.48/ogimage.html?uncache1234 2. Save the post and you will see the XSS will fire F151911 Though you now escape the OpenGraph data, the whitelistedgeneric onebox engine decodes variables values back at lines: 202 an...

Discourse: XSS in topics because of bandcamp preview engine vulnerability

Load http://try.discourse.org 2. Click "New topic" 3. Enter this payload https://89.223.28.48/bandcamp.com/album/index.html?XSSa2 to field with placeholder "Type title or paste a link here" 4. Wait for the preview engine to parse the link 4. XSS will fire F151439 You should sanitize external...

Discourse: XSS vulnerability on Audio and Video parsers

Just like in the XSS vulnerability on Image parser, there is the same vulnerability on Audio https://github.com/discourse/onebox/blob/394409ca319cc1a1cd31fefa50c9468c990531a3/lib/onebox/engine/audioonebox.rb and Video...