CVE-2021-43827

Inline footnotes wrapped in <a> tags can cause errors in discourse-footnotes

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.

discourse-footnote es una biblioteca que proporciona notas a pie de página para los mensajes en Discourse. ### Impacto Cuando es publicada una nota al pie de página en línea envuelta en etiquetas "(a)" (por ejemplo, "(a)^[footnote](/a)", el HTML resultante incluye un "(a)" anidado, que es eliminado por Nokogiri porque no es válido. Esto causaba un error de javascript en las páginas de los temas porque buscábamos un elemento "(a)" dentro del span de referencia de la nota al pie y obteníamos su ID, y como no se presentaba obteníamos un error de referencia null en javascript. Es recomendado a usuarios que actualicen a la versión 0.2. Como solución a este problema, pueden editarse las entradas en cuestión desde la consola de rails o la consola de la base de datos en el caso de los auto alojados, o deshabilitar el plugin en el panel de administración

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-16 CVE Reserved
2021-12-14 CVE Published
2023-07-07 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-755: Improper Handling of Exceptional Conditions

CAPEC

References (2)

URL	Tag	Source
https://github.com/discourse/discourse-footnote/security/advisories/GHSA-58vr-c56v-qr57	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/discourse/discourse-footnote/commit/796617e0131277011207541313522cd1946661ab	2021-12-29

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Discourse Search vendor "Discourse"		Discourse Footnote Search vendor "Discourse" for product "Discourse Footnote"				< 0.2 Search vendor "Discourse" for product "Discourse Footnote" and version " < 0.2"		discourse		Affected