We received an e-mail from a security researcher bringing the issue mentioned below to our attention. I am not a security expert so I cannot tell you whether this is right or wrong. I forwarded this to Discourse support in February 2021 and have not received a response. I’d like to know: whethe…

It appears to be that what they’re talking about is our oneboxing functionality . [immagine] Digital-Larry: A server-side request forgery vulnerability It’s not a vulnerability; it’s intended behaviour. If a URL is posted to a Discourse forum, an outbound request is done to attempt to retriev…

Thanks for the response. I’ve sent a link to this thread back to the person who reported the issue (or feature as the case may be) to us. Cheers, DL

Vulnerabilità di falsificazione di richieste lato server

Supporto

Digital-Larry (Digital Larry) 15 Aprile 2021, 7:21pm 3

Grazie per la risposta. Ho inviato un link a questo thread alla persona che ci ha segnalato il problema (o la funzionalità, a seconda dei casi).

Cordiali saluti,

Argomento		Risposte	Visualizzazioni
Blind SSRF on sending images on private conversation Support	1	1513	Febbraio 14, 2022
Discourse Performance Reports Self-hosting hosting	16	2942	Aprile 18, 2017
Site is accessible on the IP address when not following th install guide Feature	17	2333	Giugno 30, 2020
Internal oneboxing problem revisited Support	5	1044	Luglio 10, 2017
Sucuri reports a malware infection? Support	5	2511	Giugno 5, 2016

Vulnerabilità di falsificazione di richieste lato server

Argomenti correlati