CVE-2024-39905: Red-DiscordBot Incorrect Authorization in commands API
Summary
CVE-2024-39905: Red-DiscordBot vulnerable to Incorrect Authorization in commands API. Affects red-discordbot versions >= 3.5.0, < 3.5.10. Fixed in 3.5.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Red-DiscordBot is an open-source Python package that provides a framework for creating and managing Discord bots. It offers various features and functionalities to enhance the Discord experience for users. However, a vulnerability has been identified in the commands API of Red-DiscordBot, which can lead to incorrect authorization in certain scenarios.
Vulnerability Detail
The vulnerability arises from a bug in Red's Core API, specifically in the @commands.can_manage_channel() command permission check. When this permission check is used without additional controls, it may mistakenly authorize a user to run a command even if they do not have the necessary permissions to manage a channel. This issue does not affect the core commands or core cogs of Red-DiscordBot. At the time of writing this advisory, no public 3rd-party cog utilizing this API has been identified. The vulnerability has a CVSSv3 score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.5.10
This is the first release that contains the fix.
pip install --upgrade "red-discordbot==3.5.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to unload any cog that uses the @commands.can_manage_channel() command permission check. This will prevent the vulnerability from being exploited until the upgrade can be performed.
Conclusion
In conclusion, Red-DiscordBot is susceptible to an incorrect authorization vulnerability in its commands API. This vulnerability can allow unauthorized users to run commands they should not have access to. It is crucial to upgrade to the patched version, 3.5.10 or later, to mitigate this issue. If immediate upgrading is not possible, unloading any cog that uses the vulnerable command permission check can serve as a temporary workaround.
See every vulnerability recorded for red-discordbot →
FAQ
Red-DiscordBot is an open-source Python package that provides a framework for creating and managing Discord bots. It offers various features and functionalities to enhance the Discord experience for users.
The vulnerability affects Red-DiscordBot version 3.5.0. However, it was fixed in version 3.5.10 and later.
No, the core commands and core cogs of Red-DiscordBot are not affected by this vulnerability.
No, the maintainers of Red-DiscordBot are not aware of any public 3rd-party cog utilizing the vulnerable API at the time of writing this advisory.
The vulnerability has a CVSSv3 score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for red-discordbot.
