CVE-2023-36818 (published 2023-07-14T22:15Z)

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Blake Erickson
author_date: 2023-07-11 15:25:01-06:00
msg: SECURITY: limit amount of links in custom sidebar section (#22543)

Custom sidebar section can have maximum of 50 links

Co-authored-by: Krzysztof Kotlarek <kotlarek.krzysztof@gmail.com>
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: sidebar_sections_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,8 @@ class SidebarSectionsController < ApplicationController
     render_serialized(sidebar_section, SidebarSectionSerializer)
   rescue ActiveRecord::RecordInvalid => e
     render_json_error(e.record.errors.full_messages.first)
+  rescue ActiveRecord::NestedAttributes::TooManyRecords => e
+    render_json_error(e.message)
   end
 
   def update
@@ -62,6 +64,8 @@ class SidebarSectionsController < ApplicationController
     render_serialized(sidebar_section.reload, SidebarSectionSerializer)
   rescue ActiveRecord::RecordInvalid => e
     render_json_error(e.record.errors.full_messages.first)
+  rescue ActiveRecord::NestedAttributes::TooManyRecords => e
+    render_json_error(e.message)
   rescue Discourse::InvalidAccess
     render json: failed_json, status: 403
   end

programming_language: Ruby
filename: sidebar_section.rb
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,9 @@ class SidebarSection < ActiveRecord::Base
            source: :linkable,
            source_type: "SidebarUrl"
 
-  accepts_nested_attributes_for :sidebar_urls, allow_destroy: true
+  accepts_nested_attributes_for :sidebar_urls,
+                                allow_destroy: true,
+                                limit: -> { SiteSetting.max_sidebar_section_links }
 
   before_save :set_system_user_for_public_section
 

programming_language: Ruby
filename: site_settings.yml
change_type: ModificationType.MODIFY
diff: @@ -2137,6 +2137,9 @@ developer:
     default: ""
     allow_any: false
     refresh: true
+  max_sidebar_section_links:
+    default: 50
+    hidden: true
 
 navigation:
   navigation_menu:

programming_language: CoffeeScript
filename: sidebar_sections_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -87,6 +87,24 @@ RSpec.describe SidebarSectionsController do
       expect(sidebar_section.sidebar_urls.fourth.external).to be false
     end
 
+    it "validates max number of links" do
+      SiteSetting.max_sidebar_section_links = 5
+
+      sign_in(user)
+
+      links =
+        6.times.map do
+          { icon: "external-link-alt", name: "My preferences", value: "/my/preferences" }
+        end
+
+      post "/sidebar_sections.json", params: { title: "custom section", links: links }
+
+      expect(response.status).to eq(422)
+      expect(response.parsed_body["errors"]).to eq(
+        ["Maximum 5 records are allowed. Got 6 records instead."],
+      )
+    end
+
     it "does not allow regular user to create public section" do
       sign_in(user)
 
@@ -236,6 +254,28 @@ RSpec.describe SidebarSectionsController do
       )
     end
 
+    it "validates limit of links" do
+      SiteSetting.max_sidebar_section_links = 5
+
+      sign_in(user)
+
+      links =
+        6.times.map do
+          { icon: "external-link-alt", name: "My preferences", value: "/my/preferences" }
+        end
+
+      put "/sidebar_sections/#{sidebar_section.id}.json",
+          params: {
+            title: "custom section",
+            links: links,
+          }
+
+      expect(response.status).to eq(422)
+      expect(response.parsed_body["errors"]).to eq(
+        ["Maximum 5 records are allowed. Got 6 records instead."],
+      )
+    end
+
     it "doesn't allow to edit other's sections" do
       sidebar_section_2 = Fabricate(:sidebar_section)
       sidebar_url_3 = Fabricate(:sidebar_url, name: "other_tags", value: "/tags")

programming_language: Ruby