Forem vulnerabilities

Forem before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c stores an unsanitized value from feedback_message[message] and renders it via raw() in the admin view when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser, potentially exposing sensitive in-page data, CSRF tokens, or performing administrative actions. The public FeedbackMessagesController accepts the report without authorization and previously allowed a submitted offender_id, making the vulnerable path reachable by an unauthenticated attacker.

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments.

An SSRF vulnerability in forem up to v2022.11.11 allows an attacker to send a crafted POST request to the /articles/{id} endpoint, enabling access to network resources and sensitive information.