beesco00/cve-2024-52794-discourse-stored-xssStored XSS in Discourse via image filename - CVE-2024-52794
I discovered a stored cross-site scripting (XSS) vulnerability in Discourse, an open-source forum platform. The vulnerability allows an attacker to execute arbitrary JavaScript in the victim’s browser by injecting a malicious payload into the filename of an uploaded image. This affects several user interaction vectors, including public topics, comments, and private messages.
When uploading an image, the filename is rendered without proper sanitization in the frontend. If the filename includes a JavaScript payload, e.g.:
<script>alert(document.domain)</script>
...it will be executed when a user clicks the image. This applies to:
The vulnerable logic failed to encode or strip script tags from img alt attributes or the surrounding markup.
document.cookie)| Channel | Versions Affected |
|---|---|
| Stable | ≤ 3.3.2 |
| Beta | ≤ 3.4.0.beta3 |
| Tests-passed | ≤ 3.4.0.beta3 |
| Channel | Patched in Version |
|---|---|
| Stable | ≥ 3.3.3 |
| Beta | ≥ 3.4.0.beta4 |
| Tests-passed | ≥ 3.4.0.beta4 |
The issue was addressed by properly sanitizing user-supplied filenames and escaping all dynamic content in image rendering components.
| Date | Event |
|---|---|
| Nov 18, 2024 | Vulnerability reported via hackerone |
| Dec 19, 2024 | CVE assigned: CVE-2024-52794 |
| Dec 19, 2024 | Public advisory published by Discourse |