Blind SSRF on sending images on private conversation

[david (David Taylor)]

Discourse intentionally fetches images and URLs which are included in posts. We have safeguards in place to ensure that those requests cannot target hosts within the server’s private network. Receiving a GET request to a ‘canary token’ does not mean there is a vulnerability.

Please feel free to direct the researcher to our official HackerOne programme. Our policy covers this kind of report:

Ineligible vulnerability types

• SSRF - Discourse includes features (e.g. Onebox) which deliberately allow end-users to initiate server-side requests to external resources. SSRF reports will only be considered eligible if they allow requests to be made to IPs in a private range.