Uploading .eml file creates unwanted users- and sends them others' PMs

Contribute Bug

AI-generated summary

A private group experienced a privacy breach when a user uploaded an .eml file to a private message (PM). The file contained email addresses of non-group members, who were then added as staged users by Discourse and received subsequent emails from the PM. The group uses Single Sign-On (SSO) and had allowed all upload file types (*).

Mark_Schmucker initially suspected that Discourse scanned the .eml file for email addresses, but gerhard suggested that the issue might be related to incoming emails and site settings. However, Mark_Schmucker confirmed that the .eml file was indeed uploaded and not forwarded as an email.

The issue was likely caused by the enable_staged_users setting, which Mark_Schmucker has since disabled to prevent similar incidents in the future.

1

We are a strictly private group, and we discuss the merits of “sponsors”, who are not allowed in the group. We use SSO. Two of our users had a private message, and one uploaded an eml (email) file to the PM. The eml file contained the email addresses of three sponsors. Discourse discovered the email addresses, added the sponsors as staged users, and- even though they were still staged- emailed the sponsors subsequent posts in the PM. Obviously this violated our privacy.

To be fair, I had opened up the allowed upload file types to “*”, or allow all uploads. By default, they could not have uploaded an eml file. But what about a Word document? Will Discourse scan it for email addresses and add them as users?

To repro:

  1. Start a PM
  2. Find an old email from your ex
  3. Upload the eml file to the PM
  4. Your ex is now a staged user
  5. Continue the PM
  6. Your ex gets emails
1 Like
2

Are you sure that the .eml file was uploaded or did someone forward an email to the PM?

There isn’t any special handling for uploaded files that would create staged users, but incoming emails can create staged users depending on your site settings. You might want to take a look at settings like forwarded_emails_behaviour and enable_staged_users.

5 Likes
3

It was an incoming email:

image

The incoming email shows up as an eml attachment(?) which created the staged users:

image
image948×518 28.8 KB

My settings. So I will deselect “enable staged users”. I’m sure there is some valid use case for that option.

image
image510×131 4.54 KB

image

4 Likes