We received an e-mail from a security researcher bringing the issue mentioned below to our attention. I am not a security expert so I cannot tell you whether this is right or wrong. I forwarded this to Discourse support in February 2021 and have not received a response. I’d like to know: whethe…

It appears to be that what they’re talking about is our oneboxing functionality . [imagen] Digital-Larry: A server-side request forgery vulnerability It’s not a vulnerability; it’s intended behaviour. If a URL is posted to a Discourse forum, an outbound request is done to attempt to retrieve …

Thanks for the response. I’ve sent a link to this thread back to the person who reported the issue (or feature as the case may be) to us. Cheers, DL

Vulnerabilidad de falsificación de solicitud del lado del servidor

Soporte

Digital-Larry (Digital Larry) 15 Abril, 2021 19:21 3

Gracias por la respuesta. He enviado un enlace a este hilo a la persona que nos reportó el problema (o la función, según corresponda).

Saludos,

Tema		Respuestas	Vistas
Blind SSRF on sending images on private conversation Support	1	1513	14 Febrero 2022
Discourse Performance Reports Self-hosting hosting	16	2941	18 Abril 2017
Site is accessible on the IP address when not following th install guide Feature	17	2332	30 Junio 2020
Internal oneboxing problem revisited Support	5	1044	10 Julio 2017
Sucuri reports a malware infection? Support	5	2511	5 Junio 2016

Vulnerabilidad de falsificación de solicitud del lado del servidor

Temas relacionados