Discourse Anonymous Cache Poisoning Vulnerability

A vulnerability exists in Discourse versions prior to 3.3.2 and tests-passed versions prior to 3.4.0.beta3, allowing attackers to craft requests that poison the anonymous cache. This can result in cached responses lacking essential preloaded data, and it specifically impacts anonymous users on the site.

Impact

Exploitation of this vulnerability allows for anonymous cache poisoning, which can disrupt the proper functioning of the cache by introducing responses that are missing critical preloaded information.

Remediation

Users are advised to upgrade to Discourse version 3.3.2 or later. For those unable to upgrade, the anonymous cache can be disabled by setting the DISCOURSE_DISABLE_ANON_CACHE environment variable to a non-empty value.