CVE-2021-43827 Inline footnotes wrapped in <a> tags can cause errors in discourse-footnotes
A null reference error in JavaScript occurs when rendering inline footnotes wrapped in anchor tags, causing errors on topic pages for Discourse users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-43827?
CVE-2021-43827 is a medium-severity vulnerability in discourse-footnote, published on 14 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.
Weakness: CWE-755
Which versions are affected by CVE-2021-43827?
It affects 1 product.
Products include Discourse Discourse Footnote.
How do I fix CVE-2021-43827?
No fix has been published for CVE-2021-43827 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-43827 being exploited?
There is no known exploitation of CVE-2021-43827 in the wild and no public exploit code.
Sources
Also known as GHSA-58vr-c56v-qr57.