We received an e-mail from a security researcher bringing the issue mentioned below to our attention. I am not a security expert so I cannot tell you whether this is right or wrong. I forwarded this to Discourse support in February 2021 and have not received a response. I’d like to know: whethe…

It appears to be that what they’re talking about is our oneboxing functionality . [imagem] Digital-Larry: A server-side request forgery vulnerability It’s not a vulnerability; it’s intended behaviour. If a URL is posted to a Discourse forum, an outbound request is done to attempt to retrieve …

Thanks for the response. I’ve sent a link to this thread back to the person who reported the issue (or feature as the case may be) to us. Cheers, DL

Vulnerabilidade de falsificação de solicitação do lado do servidor

Suporte

Digital-Larry (Digital Larry) Abril 15, 2021, 7:21pm 3

Obrigado pela resposta. Enviei um link para este tópico de volta à pessoa que relatou o problema (ou recurso, conforme o caso) para nós.

Abraços,

Tópico		Respostas	Visualizações
Blind SSRF on sending images on private conversation Support	1	1513	14 de Fevereiro de 2022
Discourse Performance Reports Self-hosting hosting	16	2941	18 de Abril de 2017
Site is accessible on the IP address when not following th install guide Feature	17	2332	30 de Junho de 2020
Internal oneboxing problem revisited Support	5	1044	10 de Julho de 2017
Sucuri reports a malware infection? Support	5	2511	5 de Junho de 2016

Vulnerabilidade de falsificação de solicitação do lado do servidor

Tópicos relacionados