CVE-2020-15147: Remote Code Execution in Red Discord Bot
Summary
CVE-2020-15147: Remote Code Execution in Red Discord Bot. Affects red-discordbot versions < 3.3.12. Fixed in 3.3.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Red Discord Bot is a popular open-source Python bot for Discord. It provides various features and modules to enhance the functionality of Discord servers. The Streams module in Red Discord Bot allows users to receive notifications when someone goes live on a streaming platform. Unfortunately, a remote code execution (RCE) vulnerability has been discovered in the Streams module, which can be exploited by Discord users to inject malicious code into the going live message. This vulnerability can lead to destructive actions and unauthorized access to sensitive information.
Vulnerability Detail
The RCE vulnerability in the Streams module of Red Discord Bot allows attackers to execute arbitrary code by crafting specially crafted 'going live' messages. By exploiting this vulnerability, an attacker can perform malicious actions and gain unauthorized access to sensitive data. The vulnerability has a CVSS score of 8.5, indicating a high severity level. It is crucial to address this vulnerability promptly to prevent potential damage.
How To Fix
Minimum fixed version
3.3.12
This is the first release that contains the fix.
pip install --upgrade "red-discordbot==3.3.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the bot is not immediately feasible, a temporary workaround is to unload the Streams module by executing the command 'unload streams' in the bot's environment. This will disable the vulnerable module and prevent exploitation of the RCE vulnerability. However, it is still highly recommended to update to the patched versions to fully resolve the issue.
Conclusion
The RCE vulnerability in the Streams module of Red Discord Bot poses a significant risk to Discord servers using this bot. It is crucial to update the bot to version 3.3.12 or 3.4 to patch the vulnerability and prevent potential exploitation. Unloading the Streams module can serve as a temporary workaround, but it is not a permanent solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for red-discordbot →
FAQ
The vulnerability allows attackers to execute arbitrary code, potentially leading to destructive actions and unauthorized access to sensitive information.
Update Red Discord Bot to version 3.3.12 or 3.4, which contain the necessary patches to mitigate the RCE exploit.
Yes, you can unload the Streams module by executing the command 'unload streams' in the bot's environment. However, updating to the patched versions is still highly recommended.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
You can find more information about this vulnerability in the advisory on the Cog-Creators/Red-DiscordBot GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for red-discordbot.
