Unauthorized Privilege Escalation in Mod Module of red-discordbot
Summary
CVE-2020-15278: Unauthorized privilege escalation in Mod module. Affects red-discordbot versions < 3.4.1. Fixed in 3.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
red-discordbot is an open-source Python package that provides a customizable and extensible bot for the Discord chat platform. It offers various modules and commands to enhance the functionality of Discord servers. One of the modules included is the Mod module, which allows users to perform moderation actions within a guild, such as banning or kicking members. However, a vulnerability has been discovered in the Mod module that allows unauthorized privilege escalation.
Vulnerability Detail
The vulnerability in the Mod module of red-discordbot allows Discord users with a high privilege level within a guild to bypass hierarchy checks under specific conditions. This exploit can be abused to perform destructive actions within the guild, even if the user does not have the necessary permissions. This vulnerability poses a moderate risk as it can lead to unauthorized actions and potential disruption within affected guilds.
How To Fix
Minimum fixed version
3.4.1
This is the first release that contains the fix.
pip install --upgrade "red-discordbot==3.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, there are two workarounds available. The first workaround is to unload the Mod module by using the command 'unload mod'. This will disable the module and prevent the exploit from being accessible. The second workaround is to disable the 'massban' command globally using the command 'command disable global massban'. However, it is still highly recommended to update to version 3.4.1 to fully patch the vulnerability.
Conclusion
The unauthorized privilege escalation vulnerability in the Mod module of red-discordbot can allow Discord users to perform destructive actions within a guild beyond their authorized privileges. It is crucial to update red-discordbot to version 3.4.1 or later to fully patch this vulnerability. In the meantime, unloading the Mod module or disabling the 'massban' command can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for red-discordbot →
FAQ
red-discordbot is an open-source Python package that provides a customizable and extensible bot for the Discord chat platform. It offers various modules and commands to enhance the functionality of Discord servers.
The Mod module is a component of red-discordbot that allows users to perform moderation actions within a guild, such as banning or kicking members.
Unauthorized privilege escalation refers to the exploitation of a vulnerability that allows a user to gain higher privileges or access rights than they are supposed to have. In this case, it allows Discord users to bypass hierarchy checks and perform actions beyond their authorized privileges.
The potential consequences of this vulnerability include unauthorized destructive actions within a guild, even by users who do not have the necessary permissions. This can lead to disruption, abuse, or misuse of the affected guild's resources.
To protect your guild from this vulnerability, it is recommended to update red-discordbot to version 3.4.1 or later. Additionally, you can unload the Mod module or disable the 'massban' command as temporary workarounds until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for red-discordbot.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
