جزئیات آسیب‌پذیری

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.Content, message.ReferencedMessage.Content, embed.Title, embed.Description, field.Name, and field.Value. A Discord webhook or bot can store a script payload in these fields, and the payload executes when a user exports the channel with markdown formatting disabled and opens the resulting HTML, allowing the script to read the export or alter its displayed content. This issue is fixed in version 2.47.2.

• https://github.com/Tyrrrz/DiscordChatExporter/pull/1545 x_refsource_MISC
• https://github.com/Tyrrrz/DiscordChatExporter/commit/5632d6c3867d2f79cba9578056c98caee4377c1b x_refsource_MISC
• https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/2.47.2 x_refsource_MISC
• https://github.com/Tyrrrz/DiscordChatExporter/security/advisories/GHSA-8qrv-mmch-fr9c x_refsource_CONFIRM