CVE-2024-35227 – This vulnerability in Discourse allows attacker... (How to Fix)

Q: What is the severity of CVE-2024-35227?

CVE-2024-35227 has a CVSS score of 7.5 (HIGH). This vulnerability in Discourse allows attackers to reduce availability through a denial-of-service attack by exploiting improper input validation in the Onebox feature. Attackers can craft malicious URLs that cause resource exhaustion when processed. All Discourse instances running vulnerable versions are affected.

📋 TL;DR

This vulnerability in Discourse allows attackers to reduce availability through a denial-of-service attack by exploiting improper input validation in the Onebox feature. Attackers can craft malicious URLs that cause resource exhaustion when processed. All Discourse instances running vulnerable versions are affected.

💻 Affected Systems

Products:

Discourse

Versions: All versions prior to 3.2.3 on stable branch and prior to 3.3.0.beta3 on tests-passed branch

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: All standard Discourse installations with Onebox feature enabled are vulnerable.

📦 What is this software?

Discourse by Discourse

View all CVEs affecting Discourse →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion, potentially requiring manual intervention to restore service.

🟠

Likely Case

Degraded performance or temporary service disruption affecting user experience and forum functionality.

🟢

If Mitigated

Minimal impact with proper monitoring and rapid response capabilities in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires crafting malicious URLs but does not require authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.2.3 on stable branch or 3.3.0.beta3 on tests-passed branch

Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-664f-xwjw-752c

Restart Required: Yes

Instructions:

1. Backup your Discourse instance. 2. Update to Discourse version 3.2.3 or higher. 3. Restart the Discourse application. 4. Verify the update was successful.

🧯 If You Can't Patch

Implement rate limiting on URL processing endpoints
Monitor for unusual resource consumption patterns

🔍 How to Verify

Check if Vulnerable:

Check Discourse version via admin panel or run: `cd /var/discourse && ./launcher status app`

Check Version:

cd /var/discourse && cat containers/app.yml | grep DISCOURSE_VERSION

Verify Fix Applied:

Confirm version is 3.2.3 or higher on stable branch, or 3.3.0.beta3 or higher on tests-passed branch

📡 Detection & Monitoring

Log Indicators:

Unusual number of Onebox processing requests
High CPU/memory usage spikes
Error logs related to URL processing

Network Indicators:

Multiple requests to Onebox endpoints with crafted URLs
Unusual traffic patterns to /onebox routes

SIEM Query:

source="discourse.logs" AND ("Onebox" OR "onebox") AND (error OR timeout OR "high resource")

📊 Metadata

CVE ID: CVE-2024-35227

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-20

Published: July 3, 2024

Last Updated: August 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35227, you might also want to check these: