CVE-2024-55948: Discourse Cache Poisoning Vulnerability

CVE-2024-55948 Overview

CVE-2024-55948 is a cache poisoning vulnerability in Discourse, an open source platform for community discussion. An attacker can craft an XMLHttpRequest (XHR) to poison the anonymous cache, causing it to store responses with missing preloaded data. The issue affects only anonymous visitors of the site, not authenticated users. Discourse has patched the flaw in the latest stable release. The vulnerability falls under [CWE-346] Origin Validation Error.

Critical Impact
An unauthenticated remote attacker can poison the anonymous response cache, degrading site integrity and partial availability for every anonymous visitor served from the affected cache.

Affected Products

Discourse (stable branch) prior to the patched release
Self-hosted Discourse instances serving anonymous traffic
Any Discourse deployment that has not set DISCOURSE_DISABLE_ANON_CACHE

Discovery Timeline

2025-02-04 - CVE-2024-55948 published to NVD
2025-08-26 - Last updated in NVD database

Technical Details for CVE-2024-55948

Vulnerability Analysis

Discourse maintains a server-side anonymous cache that stores rendered responses for unauthenticated visitors. The cache improves performance by reusing previously generated pages instead of regenerating them per request. The vulnerability allows an attacker to influence what gets written into this shared cache by issuing a crafted XHR request.

When the poisoned entry is served to subsequent anonymous visitors, the response can be missing preloaded data that the front-end JavaScript expects. This breaks the rendering pipeline and produces incorrect or incomplete pages for every anonymous user that hits the cached entry. Authenticated sessions bypass the anonymous cache and are not affected.

The attack requires no privileges and no user interaction. Impact is concentrated on integrity, with limited availability impact through degraded rendering for anonymous users. The Discourse component identifier is discourse:discourse.

Root Cause

The root cause is an origin validation weakness in how the anonymous cache layer accepts and stores responses associated with XHR-style requests. The cache key or response selection logic does not sufficiently distinguish requests that should not populate or overwrite cached entries served to standard navigations.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted XHR request to the Discourse instance designed to trigger a response that becomes the cached representation for anonymous viewers. Subsequent anonymous visitors then receive the poisoned response. See the GitHub Security Advisory GHSA-2352-252q-qc82 for the maintainer-confirmed details.

Detection Methods for CVE-2024-55948

Indicators of Compromise

Anonymous page responses rendering with missing or partial preloaded data fields
JavaScript errors on first paint reported by anonymous visitors but not authenticated users
Unusual bursts of XHR requests to Discourse endpoints from a single client preceding cache anomalies
Sudden drops in front-end Ember rendering success metrics for anonymous traffic

Detection Strategies

Monitor reverse proxy and Discourse application logs for repeated XHR requests targeting cacheable paths from non-browser user agents
Compare cached anonymous responses against freshly generated responses to identify drift in preloaded payloads
Alert on spikes in client-side JavaScript exceptions sourced from anonymous sessions

Monitoring Recommendations

Enable verbose request logging on the anonymous cache layer, including cache hit, miss, and store events
Track the ratio of anonymous to authenticated 5xx and rendering errors over time
Forward Discourse application and proxy logs to a centralized analytics platform for correlation

How to Mitigate CVE-2024-55948

Immediate Actions Required

Upgrade Discourse to the latest stable release that includes the patch referenced in GHSA-2352-252q-qc82
If immediate upgrade is not possible, set the DISCOURSE_DISABLE_ANON_CACHE environment variable to any non-empty value to disable the anonymous cache
Purge existing anonymous cache entries after applying the patch or workaround to remove any already-poisoned content
Review reverse proxy configurations to ensure XHR requests are not inadvertently populating downstream caches

Patch Information

Discourse has released a patched version on the stable branch. Administrators should upgrade through their standard Discourse update procedure, whether Docker-based (./launcher rebuild app) or managed hosting. The fix is documented in the GitHub Security Advisory linked above.

Workarounds

Set DISCOURSE_DISABLE_ANON_CACHE to a non-empty value in the container environment to disable the anonymous cache entirely
Restart the Discourse container after applying the environment variable so the setting takes effect
Accept the performance trade-off of disabling the cache until the patched release is deployed

bash

# Configuration example: disable Discourse anonymous cache in app.yml
env:
  DISCOURSE_DISABLE_ANON_CACHE: "true"

# Apply the configuration
cd /var/discourse
./launcher rebuild app