CVE-2024-53991: Discourse Backup File Disclosure Vulnerability

CVE-2024-53991 Overview

CVE-2024-53991 affects Discourse, an open source platform for community discussion. The vulnerability allows an unauthenticated attacker to retrieve Discourse backup files by tricking nginx into serving them with a crafted HTTP request. The issue only affects instances configured with FileStore::LocalStore, where uploads and backups are stored locally on disk. Exploitation requires the attacker to know the backup file name, which raises attack complexity. Discourse released fixes in the latest stable, beta, and tests-passed branches.

Critical Impact
Unauthenticated attackers who know a backup file name can download full Discourse backups, exposing forum content, user data, and secrets stored within the backup archive.

Affected Products

Discourse stable branch versions prior to the patched release
Discourse beta branch (including 3.4.0:beta1, 3.4.0:beta2, 3.4.0:beta3)
Discourse tests-passed branch prior to the fix

Discovery Timeline

2024-12-19 - CVE-2024-53991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53991

Vulnerability Analysis

The flaw is an information disclosure issue [CWE-200] in how Discourse and its bundled nginx configuration serve locally stored backup archives. When FileStore::LocalStore is active, backups reside on the same filesystem that nginx can reach. A crafted request bypasses the intended access controls in the Rails application and causes nginx to return the backup archive directly. Because backups contain database exports, uploaded content, and configuration data, disclosure can reveal user records, password hashes, API keys, and other secrets. The attack executes over the network without authentication or user interaction.

Root Cause

The root cause is an unsafe interaction between the nginx front-end and the Discourse application's authorization logic for backup downloads. The web server can be induced to serve the raw backup file from the local filesystem without invoking Discourse's authenticated download handler. Instances using S3 for backup storage are not affected because the file is not present on the local nginx-served volume.

Attack Vector

An attacker sends a specially crafted HTTP request to the target Discourse site. The request must reference a valid backup filename, which is typically derived from the site name and a timestamp. If nginx resolves the path to the local backup directory, it streams the archive back to the attacker. Guessing the filename is non-trivial, which is reflected in the high attack complexity, but a determined attacker with knowledge of the site's backup naming pattern can succeed. See the GitHub Security Advisory GHSA-567m-82f6-56rv for additional detail.

Detection Methods for CVE-2024-53991

Indicators of Compromise

Unexpected HTTP GET requests to backup-related URLs with unusual path segments or query strings from unauthenticated clients
nginx access.log entries returning large response sizes for requests that did not traverse the Discourse Rails application
Outbound transfers of .tar.gz backup archives to IPs not associated with administrator activity

Detection Strategies

Correlate nginx access logs with Discourse application logs to identify backup downloads that did not originate from an authenticated admin session
Alert on any request whose response size matches known backup archive sizes when the client is unauthenticated
Baseline normal admin download patterns and flag deviations in source IP, user agent, or time of day

Monitoring Recommendations

Enable verbose logging on the /admin/backups and static backup paths and forward logs to a centralized analytics platform
Monitor filesystem access to the local backup directory for reads performed by the nginx worker process
Track EPSS movement for CVE-2024-53991, currently reported at 26.788% with a 97.884 percentile, as opportunistic scanning is likely

How to Mitigate CVE-2024-53991

Immediate Actions Required

Upgrade Discourse to the latest patched stable, beta, or tests-passed release as published in the vendor advisory
If upgrade is not immediately possible, disable the enable_backups site setting and remove existing local backup files after copying them to offline storage
Rotate any credentials, API keys, or secrets that could have been contained in previously generated backups

Patch Information

Discourse has patched the vulnerability in the latest stable, beta, and tests-passed versions. Administrators should apply the update referenced in GitHub Security Advisory GHSA-567m-82f6-56rv and verify the deployed version after upgrade.

Workarounds

Change the backup_location site setting to s3 so backups are stored in and downloaded directly from S3 rather than the local filesystem
Download all local backups to another storage device, disable enable_backups, and delete all local backup files until the site is upgraded
Restrict network access to the Discourse instance at the perimeter while remediation is in progress

bash

# Configuration example: switch backup storage to S3 via site settings
# In the Discourse admin UI: Settings -> Backups -> backup_location = s3
# Or via rails console:
SiteSetting.backup_location = "s3"
SiteSetting.enable_backups = false  # temporary, until patched version is deployed