Summary
A path traversal flaw in Discourse's iframe source validation can allow a crafted URL to pass an administrator-defined allowed subpath check. When the browser normalizes the URL, the iframe may load content from outside the permitted location, bypassing the intended embedding policy.
Affected context
The issue affects Discourse installations that use iframe source restrictions based on allowed subpaths. It becomes risky when an attacker can submit or influence iframe source values that are later rendered by the platform, and when validation interprets path separators differently from browser URL normalization.
Exploit preconditions
- Attack surface: Discourse iframe source validation and rendering
- Required access: The ability to submit or influence content containing an iframe source, subject to the site's posting and moderation permissions
- Trigger point: Validation of a crafted iframe source before the browser resolves and normalizes its URL
- Why exploitation is possible: The guard does not treat literal backslashes as path separators after decoded dot segments, allowing the checked path and browser-resolved path to differ
Why this happens
The vulnerability results from inconsistent path canonicalization between application-side validation and browser URL handling. After decoded dot segments are processed, the iframe guard fails to recognize literal backslashes as separators, so a source can appear to remain within an allowed subpath during validation while the browser resolves it outside that path. This is a path traversal issue mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Potential impact
- An iframe may load content from a location the administrator did not authorize
- Site embedding policies may be bypassed
- Users could be exposed to untrusted or unexpected embedded content
- The issue could increase the risk of follow-on client-side attacks if the loaded content is malicious
General mitigation guidance
Mitigation generally focuses on applying identical, canonical URL handling during validation and browser-facing rendering.
Common defensive patterns include:
- Normalize and canonicalize URLs before applying allowlist comparisons
- Treat equivalent separator and encoded traversal forms consistently
- Compare structured URL components rather than raw strings
- Use explicit origin and path allowlists with secure-by-default denial
- Reduce trust in user-controlled iframe sources and restrict who can submit them
- Apply least privilege and suitable browser isolation for embedded content
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules targeting path validation without canonicalization
- Code review signals involving decoded dot segments, backslashes, URL parsing, and prefix-based allowlists
- Differential tests that compare application validation with browser URL resolution
- Policy enforcement requiring structured URL parsing and default-deny iframe source controls
- Security tests covering encoded separators, traversal segments, and alternate URL representations
Automated review tools may help identify inconsistent normalization logic, but behavioral tests are important for confirming browser-facing results.
