CVE-2024-56328
📋 TL;DR
This CVE allows attackers to execute arbitrary JavaScript in users' browsers by posting malicious onebox URLs in Discourse forums. It affects Discourse sites with Content Security Policy (CSP) disabled. Attackers can steal session cookies, redirect users, or perform other malicious actions.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal admin session cookies, take over forum administration, and compromise all user accounts and data.
Likely Case
Attackers steal user session cookies to hijack accounts, post spam/malicious content, or redirect users to phishing sites.
If Mitigated
With CSP enabled or patches applied, the vulnerability is prevented and no impact occurs.
🎯 Exploit Status
Exploitation requires posting privileges on the forum. The advisory provides technical details but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest version of Discourse
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-j855-mhxj-x6vg
Restart Required: Yes
Instructions:
1. Update Discourse to the latest version via standard update procedures. 2. Restart the Discourse application. 3. Verify CSP remains enabled.
🔧 Temporary Workarounds
Enable Content Security Policy
allEnable CSP in Discourse configuration to prevent the XSS attack
Set `Content Security Policy` to enabled in Discourse admin settings
Disable Inline Oneboxes Globally
allPrevent onebox rendering for all URLs to eliminate the attack vector
Set `disable inline oneboxes` to true in Discourse admin settings
🧯 If You Can't Patch
- Enable Content Security Policy in Discourse configuration
- Restrict oneboxing to specific trusted domains only
🔍 How to Verify
Check if Vulnerable:
Check if CSP is disabled in Discourse admin settings and version is unpatchedCheck Version:
Check Discourse admin dashboard or run `git log --oneline -1` in Discourse directoryVerify Fix Applied:
Verify Discourse is updated to latest version and CSP is enabled📡 Detection & Monitoring
Log Indicators:
- Unusual onebox URL patterns in post logs
- Multiple failed CSP violation reports
Network Indicators:
- Unexpected JavaScript execution from onebox URLs
- CSP violation reports in browser consoles
SIEM Query:
Search for posts containing unusual URL patterns or CSP violation events