CVE-2022-23641
Denial of Service in Discourse
In short
Discourse users can crash the platform by posting a streaming URL that causes an infinite loop in the background processing system, consuming all available memory. This allows anyone to disrupt service for all users.
Technical detail
CWE-835 infinite loop vulnerability in Onebox parsing triggered by malicious streaming URLs in user posts. The background job processing creates unbounded memory consumption leading to DoS. Attack requires only standard user privileges to post content; patched in versions 2.8.1 (stable), 2.9.0.beta2 (beta/tests-passed).
Summary generated and translated by AI from the official description.
Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.beta2 of the `tests-passed` branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
discourse · discourseWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →