CVE-2024-37157
📋 TL;DR
This vulnerability in Discourse allows attackers to manipulate the FastImage library to redirect requests to internal Discourse IP addresses, potentially enabling server-side request forgery (SSRF). All Discourse instances running vulnerable versions are affected. The attack requires the attacker to be able to submit malicious image URLs to the platform.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Attacker could access internal services, perform port scanning of internal networks, or interact with internal APIs to escalate privileges or exfiltrate sensitive data.
Likely Case
Information disclosure about internal network topology, potential access to internal services that shouldn't be exposed externally.
If Mitigated
Limited impact if network segmentation prevents internal service access from Discourse servers.
🎯 Exploit Status
Exploitation requires ability to submit image URLs to Discourse (typically requires user account).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.3 on stable branch, 3.3.0.beta4 on beta and tests-passed branches
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68
Restart Required: Yes
Instructions:
1. Backup your Discourse instance. 2. Update to Discourse 3.2.3 (stable) or 3.3.0.beta4 (beta/tests-passed). 3. Restart the Discourse application. 4. Verify the update was successful.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Discourse servers from internal services.
- Deploy web application firewall rules to block suspicious outbound requests from Discourse.
🔍 How to Verify
Check if Vulnerable:
Check Discourse version via admin panel or run: `cd /var/discourse && ./launcher status app`Check Version:
cd /var/discourse && cat containers/app.yml | grep DISCOURSE_VERSIONVerify Fix Applied:
Confirm version is 3.2.3 or higher (stable) or 3.3.0.beta4 or higher (beta/tests-passed).📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Discourse to internal IP ranges
- Failed image processing requests with internal IP addresses in URLs
Network Indicators:
- Discourse server making unexpected HTTP requests to internal network segments
SIEM Query:
source="discourse.logs" AND (url CONTAINS "192.168." OR url CONTAINS "10." OR url CONTAINS "172.16." OR url CONTAINS "127.0.0.1")🔗 References
- https://github.com/discourse/discourse/commit/5b8cf11b69e05d5c058c1148ec69ec309491fa6e
- https://github.com/discourse/discourse/commit/67e78086035cec494b15ce79342a0cb9052c2d95
- https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68
- https://github.com/discourse/discourse/commit/5b8cf11b69e05d5c058c1148ec69ec309491fa6e
- https://github.com/discourse/discourse/commit/67e78086035cec494b15ce79342a0cb9052c2d95
- https://github.com/discourse/discourse/security/advisories/GHSA-46pq-7958-fc68
