CVE-2023-45131
📋 TL;DR
Discourse chat messages can be read by unauthenticated attackers via a POST request to MessageBus, exposing private conversations. This affects all Discourse instances running vulnerable versions. The vulnerability allows unauthorized access to sensitive chat data.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of all private chat conversations to unauthenticated attackers, leading to data breaches, privacy violations, and reputational damage.
Likely Case
Unauthorized reading of private chat messages by external attackers scanning for vulnerable Discourse instances.
If Mitigated
No impact if patched versions are deployed; unpatched instances remain fully vulnerable.
🎯 Exploit Status
Simple POST request exploitation with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.1 stable or 3.2.0.beta2
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-84gf-hhrc-9pw6
Restart Required: Yes
Instructions:
1. Backup your Discourse instance. 2. Update to Discourse version 3.1.1 or later. 3. Restart the Discourse application. 4. Verify the update was successful.
🧯 If You Can't Patch
- Disable chat functionality entirely if not needed
- Implement network-level restrictions to limit access to MessageBus endpoints
🔍 How to Verify
Check if Vulnerable:
Check Discourse version via admin panel or run: `cd /var/discourse && ./launcher status app`Check Version:
cd /var/discourse && cat containers/app.yml | grep DISCOURSE_VERSIONVerify Fix Applied:
Confirm version is 3.1.1 or higher and attempt to reproduce the unauthenticated POST request to MessageBus (should fail).📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /message-bus endpoints from unauthenticated sources
- Increased traffic to chat-related endpoints
Network Indicators:
- POST requests to MessageBus without authentication headers
- Unusual data extraction patterns from chat endpoints
SIEM Query:
source="discourse.logs" AND (uri_path="/message-bus" OR uri_path="/chat") AND http_method="POST" AND user_id="-"