github.comConfirmation
https://github.com/discourse/discourse/security/advisories/GHSA-567m-82f6-56rv CVE-2024-53991
HIGHNuclei
Potential Backup file leaked via Nginx in Discourse
Record summary
CVE-2024-53991 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.
Description
Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade can either 1. Download all local backups on to another storage device, disable the `enable_backups` site setting and delete all backups until the site has been upgraded to pull in the fix. Or 2. Change the `backup_location` site setting to `s3` so that backups are stored and downloaded directly from S3.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 20, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
discourseBrowse discourse / discourse | CVE List | stable: <= 3.3.2 | affected |
| beta: <= 3.4.0.beta3 | affected | ||
| tests-passed: <= 3.4.0.beta3 | affected |
Nuclei templates
1ProjectDiscoveryHIGHDiscourse Backup File Disclosure Via Default Nginx ConfigurationCVSS 7.5
Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore--LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request.
Impact
Attackers who know the backup file name can bypass nginx access controls to download complete Discourse backup files containing sensitive data, user information, and database contents.
Remediation
Update to the latest stable, beta or tests-passed version of Discourse. Alternatively, store backups on S3 or disable backups temporarily until the fix is applied.
WeaknessesCWE-200
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024discoursedisclosurevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Shodan: http.component:"Discourse"
https://projectdiscovery.io/blog/discourse-backup-disclosure-rails-send_file-quirk/ https://github.com/discourse/discourse/security/advisories/GHSA-567m-82f6-56rv
Source: ProjectDiscovery