CVE-2023-48297
📋 TL;DR
Discourse's message serializer mishandles expanded chat mentions (@all and @here), creating excessively large user arrays that can cause denial of service. This affects all Discourse instances running vulnerable versions, potentially disrupting community discussions.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion from processing massive user arrays, leading to extended downtime.
Likely Case
Performance degradation or temporary service interruptions when @all/@here mentions are used in large communities.
If Mitigated
Minimal impact with proper monitoring and resource limits, though potential for brief performance issues remains.
🎯 Exploit Status
Exploitation requires authenticated user access to post messages with @all or @here mentions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.4 or 3.2.0.beta5
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-hf2v-r5xm-8p37
Restart Required: Yes
Instructions:
1. Backup your Discourse instance. 2. Update to Discourse version 3.1.4 or later. 3. Restart the application server. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable @all and @here mentions
allTemporarily disable the expanded mention functionality to prevent exploitation.
Edit site settings to disable @all and @here mentions in chat
🧯 If You Can't Patch
- Implement rate limiting on chat message posting
- Monitor system resources and set alerts for abnormal memory/CPU usage
🔍 How to Verify
Check if Vulnerable:
Check Discourse version via admin panel or run: `cd /var/discourse && ./launcher status app`Check Version:
cd /var/discourse && cat containers/app.yml | grep DISCOURSE_VERSIONVerify Fix Applied:
Confirm version is 3.1.4 or higher, or 3.2.0.beta5 or higher for beta installations.📡 Detection & Monitoring
Log Indicators:
- Unusually large memory consumption spikes
- Application errors related to message serialization
Network Indicators:
- Increased response times for chat endpoints
- Timeout errors on message posting
SIEM Query:
source="discourse_logs" AND ("@all" OR "@here") AND memory_usage > threshold