Discourse Welcome Banner User Name XSS Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the welcome banner user name string for logged-in users on Discourse. This issue can affect the user themselves or an admin impersonating them. The vulnerability arises because the welcome banner can be manipulated to include HTML, which is then rendered, creating an XSS risk. Admins can temporarily remove the 'preferred_display_name' placeholder from the welcome banner text to mitigate this issue, or avoid impersonating users.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an admin can change the welcome banner text to include a logged-in user's name with embedded HTML, such as an input tag. This will render the HTML in the banner, creating an XSS vulnerability for the user or an admin impersonating them.

Remediation

Users can update to Discourse version 3.5.0.beta8 or later, where this vulnerability has been patched.