PT-2023-28903 · Discourse · Discourse-Encrypt

Highzogstrip · Published 2023-09-28 · Updated 2023-10-02 · CVE-2023-43657

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions discourse-encrypt plugin (affected versions not specified)

Description The discourse-encrypt plugin provides a secure communication channel through Discourse. However, improper escaping of encrypted topic titles could lead to a cross-site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard.

Recommendations To resolve the issue, users are advised to upgrade to the latest version of the discourse-encrypt plugin, which includes the fix in commit 9c75810af9. Users unable to upgrade should ensure that CSP headers are enabled and properly configured. As a temporary workaround, consider enabling CSP headers to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-43657

GHSA-5FH6-WP7P-XX7V

Affected Products

Discourse-Encrypt

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43657.json · Exploit
• https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e · Patch
• https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43657 · Security Note
• https://twitter.com/CVEnew/status/1707460156664250466 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1707495818184343576 · Twitter Post
• https://t.me/cibsecurity/71226 · Telegram Post
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP · Note
• https://twitter.com/IT_securitynews/status/1708414521054814557 · Twitter Post