Discourse Anonymous Cache Poisoning Vulnerability

A vulnerability exists in Discourse versions prior to 3.3.2 and tests-passed versions prior to 3.4.0.beta3, allowing attackers to craft XHR requests that poison the anonymous cache. This can result in cached responses lacking essential preloaded data. The issue impacts only anonymous visitors to the site.

Impact

Exploitation of this vulnerability allows for anonymous cache poisoning, which can disrupt the delivery of preloaded data to users.

Remediation

Users are advised to upgrade to Discourse version 3.3.2 or later. For those unable to upgrade, the anonymous cache can be disabled by setting the DISCOURSE_DISABLE_ANON_CACHE environment variable to a non-empty value.