CVE-2020-26249: Red Discord Bot Dashboard RCE Vulnerability
Summary
CVE-2020-26249: Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. Affects red-dashboard across 3 version ranges.
< 0.1.7a
< 99d88b840674674166ce005b784ae8e31e955ab1
< a6b9785338003ec87fb75305e7d1cc2d40c7ab91
Fixed in a6b9785338003ec87fb75305e7d1cc2d40c7ab91. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Red Discord Bot Dashboard is an interactive web dashboard used to control the Redbot. It provides an easy-to-use interface for managing the bot's functionalities. The vulnerability affects Red Discord Bot versions prior to 0.1.7a. The exploit allows Discord users to inject code into the webserver front-end code by using specially crafted Server names and Usernames/Nicknames. This can lead to destructive actions and unauthorized access to sensitive information.
Vulnerability Detail
The RCE vulnerability in Red Discord Bot Dashboard allows attackers to execute arbitrary code on the webserver. By manipulating the Server names and Usernames/Nicknames, an attacker can inject malicious code into the front-end code. This can result in various harmful actions, such as unauthorized data access, data manipulation, or even complete server compromise. The vulnerability has a high severity rating and poses a significant risk to bot owners and their data.
How To Fix
Minimum fixed version
a6b9785338003ec87fb75305e7d1cc2d40c7ab91
This is the first release that contains the fix.
pip install --upgrade "red-dashboard==a6b9785338003ec87fb75305e7d1cc2d40c7ab91"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The RCE vulnerability in Red Discord Bot Dashboard can be mitigated by upgrading the Dashboard module and Dashboard webserver to version 0.1.7a or later. It is crucial for bot owners to promptly apply this update to protect their bots and prevent potential unauthorized access or data manipulation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for red-dashboard →
FAQ
Red Discord Bot Dashboard is an interactive web dashboard used to control the Redbot. It provides a user-friendly interface for managing the bot's functionalities.
The vulnerability allows attackers to execute arbitrary code on the webserver, potentially leading to unauthorized data access, data manipulation, or server compromise.
To fix this vulnerability, you need to upgrade the Dashboard module and Dashboard webserver to version 0.1.7a or later.
No, there are no known workarounds for this vulnerability. Upgrading the relevant packages is the only recommended solution.
You can find more information about this vulnerability in the Red Discord Bot Dashboard advisory on the PyPI advisory database.
