Discourse Cross-Site Scripting Vulnerability in Social Login OAuth Flow

A cross-site scripting (XSS) vulnerability has been identified in Discourse, an open-source discussion platform, affecting versions prior to 3.5.0.beta6. The issue arises when the content security policy (CSP) is not enabled during social login OAuth failure flow, allowing for user-provided query parameters to be exploited. Discourse version 3.5.0.beta6 addresses this vulnerability. Users can enable the content security policy as a workaround.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Discourse version 3.5.0.beta6 or later to address this vulnerability. As an additional step, enabling the content security policy can help mitigate the issue.