CVE-2024-36122 (published 2024-07-03T20:15Z)

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. As possible workarounds, either prevent moderators from accessing the review queue or disable the approve suspect users site setting and the must approve users site setting to prevent users from being added to the review queue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Blake Erickson
author_date: 2024-05-30 11:30:06-06:00
msg: SECURITY: Update reviewable user serializer payload

Exclude email from reviewable user serializer based on user scope.
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: reviewable_user_serializer.rb
change_type: ModificationType.MODIFY
diff: @@ -16,4 +16,14 @@ class ReviewableUserSerializer < ReviewableSerializer
   def include_user_fields?
     object.target.present? && object.target.user_fields.present?
   end
+
+  def attributes(*args)
+    data = super
+    data[:payload]&.delete("email") if !include_email?
+    data
+  end
+
+  def include_email?
+    scope.can_check_emails?(scope.user)
+  end
 end

programming_language: Ruby
filename: reviewable_user_serializer_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -3,12 +3,15 @@
 RSpec.describe ReviewableUserSerializer do
   let(:user) { Fabricate(:user) }
   let(:admin) { Fabricate(:admin) }
+  let(:moderator) { Fabricate(:moderator) }
+  let(:reviewable) { Reviewable.find_by(target: user) }
 
-  it "includes the user fields for review" do
+  before do
     SiteSetting.must_approve_users = true
     Jobs::CreateUserReviewable.new.execute(user_id: user.id)
-    reviewable = Reviewable.find_by(target: user)
+  end
 
+  it "includes the user fields for review" do
     json = ReviewableUserSerializer.new(reviewable, scope: Guardian.new(admin), root: nil).as_json
     expect(json[:user_id]).to eq(reviewable.target_id)
     expect(json[:payload]["username"]).to eq(user.username)
@@ -16,4 +19,26 @@ RSpec.describe ReviewableUserSerializer do
     expect(json[:payload]["name"]).to eq(user.name)
     expect(json[:topic_url]).to be_blank
   end
+
+  it "excludes the email user field for moderators" do
+    json =
+      ReviewableUserSerializer.new(reviewable, scope: Guardian.new(moderator), root: nil).as_json
+    expect(json[:user_id]).to eq(reviewable.target_id)
+    expect(json[:payload]["username"]).to eq(user.username)
+    expect(json[:payload]["email"]).to eq(nil)
+    expect(json[:payload]["name"]).to eq(user.name)
+    expect(json[:topic_url]).to be_blank
+  end
+
+  it "includes the email user field for moderators if enabled" do
+    SiteSetting.moderators_view_emails = true
+
+    json =
+      ReviewableUserSerializer.new(reviewable, scope: Guardian.new(moderator), root: nil).as_json
+    expect(json[:user_id]).to eq(reviewable.target_id)
+    expect(json[:payload]["username"]).to eq(user.username)
+    expect(json[:payload]["email"]).to eq(user.email)
+    expect(json[:payload]["name"]).to eq(user.name)
+    expect(json[:topic_url]).to be_blank
+  end
 end

programming_language: Ruby