CVE-2023-30538 Stored Cross-site Scripting via improper sanitization of svg files in Discourse
Attackers can execute arbitrary JavaScript in user browsers by uploading crafted SVG files, requiring SVG uploads to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-30538?
CVE-2023-30538 is a medium-severity cross-site scripting vulnerability in Discourse Discourse, published on 18 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on the users’ browsers by uploading a crafted SVG file. This issue is patched in the latest stable and tests-passed versions of Discourse. Users are advised to upgrade. For users unable to upgrade there are two possible workarounds: enable CDN handing of uploads (and ensure the CDN sanitizes SVG files) or disable SVG file uploads by ensuring that the `authorized extensions` site setting does not include `svg` (or reset that setting to the default, by default Discourse doesn't enable SVG uploads by users).
Weakness: CWE-79
Which versions are affected by CVE-2023-30538?
1 open source package ship an affected version, including discourse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
discourse Bitnami | All versions to 3.0.2 | 3.1.0 |
Products include Discourse Discourse.
How do I fix CVE-2023-30538?
Upgrade discourse to 3.1.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-30538 being exploited?
There is no known exploitation of CVE-2023-30538 in the wild and no public exploit code.
Other vulnerabilities in Discourse Discourse
- CVE-2021-41163 RCE via malicious SNS subscription payload
- CVE-2022-36066 Discourse vulnerable to RCE via admins uploading maliciously zipped file
- CVE-2022-39356 Discourse user account takeover via email and invite link
- CVE-2023-22468 Discourse vulnerable to Cross-site Scripting in local oneboxes
- CVE-2026-27934 Discourse leaks private topic title and post excerpt via user action API endpoint
Sources
Also known as BIT-discourse-2023-30538, GHSA-w5mv-4pjf-xj43.