CVE-2024-56328: Discourse XSS Vulnerability via Onebox URLs

CVE-2024-56328 Overview

CVE-2024-56328 is a stored cross-site scripting (XSS) vulnerability in Discourse, an open source platform for community discussion. An attacker can execute arbitrary JavaScript in users' browsers by posting a maliciously crafted onebox URL. The flaw only affects Discourse instances running with Content Security Policy (CSP) disabled. Discourse has patched the issue in the latest stable and beta releases, and administrators are advised to upgrade immediately. The vulnerability is classified as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in the browsers of Discourse users on sites where CSP is disabled, enabling session hijacking, credential theft, and forum defacement.

Affected Products

Discourse stable releases prior to the patched version
Discourse beta releases prior to the patched version
Discourse 3.4.0-beta1, 3.4.0-beta2, and 3.4.0-beta3

Discovery Timeline

2025-02-04 - CVE-2024-56328 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56328

Vulnerability Analysis

Discourse's onebox feature generates rich previews for URLs posted in topics and replies. The vulnerability allows an attacker to craft a onebox URL whose preview output contains attacker-controlled markup that renders as executable JavaScript in the victim's browser. Because oneboxes are rendered when other users view the post, this is a stored XSS condition that persists across sessions. Exploitation requires user interaction, specifically that a target user views a page containing the malicious onebox.

Root Cause

The root cause is improper neutralization of user-supplied content during onebox generation, allowing HTML or script content to be reflected into rendered posts without adequate sanitization. Discourse relies on Content Security Policy as a defense-in-depth control to block inline script execution, so the flaw is only exploitable when CSP is disabled at the site level. Administrators who turned off CSP for compatibility reasons therefore lose the mitigation that would otherwise blunt the impact of onebox parsing bugs.

Attack Vector

An attacker with the ability to post content submits a URL that triggers the vulnerable onebox parser. When any other authenticated or unauthenticated user loads the topic, the malicious payload executes in their browser under the Discourse origin. The attacker can then steal session cookies, perform actions on behalf of the victim, exfiltrate profile data, or pivot to administrator accounts if a staff member views the post. See the Discourse GitHub Security Advisory GHSA-j855-mhxj-x6vg for technical details.

Detection Methods for CVE-2024-56328

Indicators of Compromise

Posts containing onebox URLs pointing to unusual or attacker-controlled domains that return HTML containing <script> tags, event handlers such as onerror or onload, or javascript: URIs.
Unexpected outbound requests from user browsers to attacker-controlled domains after rendering a topic page.
Anomalous session activity or account changes performed by users shortly after viewing a topic containing an external onebox.

Detection Strategies

Review the Discourse posts table for onebox HTML containing script tags, inline event handlers, or encoded JavaScript payloads.
Inspect web server and reverse proxy logs for onebox fetches to newly seen or low-reputation domains correlated with post creation events.
Monitor browser-side telemetry or CSP violation reports (if CSP is enabled in report-only mode) for inline script execution on Discourse pages.

Monitoring Recommendations

Enable and monitor CSP violation reporting even on sites where enforcement is disabled, to surface XSS attempts early.
Alert on Discourse admin and moderator account actions occurring within short windows after viewing external oneboxes.
Track version and plugin state of Discourse deployments to confirm patched builds are running across all environments.

How to Mitigate CVE-2024-56328

Immediate Actions Required

Upgrade Discourse to the latest patched stable or beta release referenced in GHSA-j855-mhxj-x6vg.
Verify that Content Security Policy is enabled site-wide in Discourse admin settings.
Audit recent posts for suspicious onebox URLs and remove any confirmed malicious content.
Rotate session secrets and force re-authentication for staff accounts if exploitation is suspected.

Patch Information

Discourse released fixes in the latest stable and beta versions. Administrators should consult the Discourse GitHub Security Advisory for the exact patched version numbers and apply the upgrade through the standard Discourse update procedure.

Workarounds

Enable Content Security Policy in Discourse admin settings, which blocks execution of the injected inline script.
Disable inline oneboxes globally to prevent the vulnerable rendering path from executing.
Restrict oneboxing to an explicit allowlist of trusted domains so untrusted URLs cannot trigger the parser.

bash

# Configuration example - enable CSP and restrict oneboxes via Discourse admin settings
# Admin > Settings > Security
content_security_policy: true
content_security_policy_strict_dynamic: true

# Admin > Settings > Onebox
enable_inline_onebox_on_all_domains: false
allowed_inline_onebox_domains: "example.com|trusted-site.org"