CVE-2020-15278: Unauthorized Privilege Escalation in Red Discord Bot
Summary
CVE-2020-15278: Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. Affects red-discordbot across 2 version ranges.
< 3.4.1
< 726bfd38adfdfaef760412a68e01447b470f438b
Fixed in 726bfd38adfdfaef760412a68e01447b470f438b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Red Discord Bot is a Python-based open-source bot for the Discord chat platform. It provides various features and modules to enhance the functionality of Discord servers. The Mod module in Red Discord Bot allows users with high privilege levels within a guild to moderate and manage the server. However, a vulnerability in the Mod module prior to version 3.4.1 allows unauthorized privilege escalation, enabling users to bypass hierarchy checks and perform destructive actions within the guild they have high privileges in.
Vulnerability Detail
The unauthorized privilege escalation exploit in the Mod module of Red Discord Bot allows Discord users with high privilege levels to bypass hierarchy checks under specific conditions. This exploit can be abused to perform destructive actions within the affected guild. The vulnerability has been fixed in version 3.4.1. The exploit can be mitigated by unloading the Mod module or disabling the massban command. However, it is highly recommended to update to version 3.4.1 to fully patch this issue.
How To Fix
Minimum fixed version
726bfd38adfdfaef760412a68e01447b470f438b
This is the first release that contains the fix.
pip install --upgrade "red-discordbot==726bfd38adfdfaef760412a68e01447b470f438b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, the Mod module can be unloaded using the 'unload mod' command. Additionally, the massban command can be disabled globally using the 'command disable global massban' command. These measures can render the unauthorized privilege escalation exploit inaccessible.
Conclusion
The unauthorized privilege escalation vulnerability in the Mod module of Red Discord Bot can be exploited by Discord users with high privilege levels. To mitigate the risk, it is recommended to update Red Discord Bot to version 3.4.1 or later. Alternatively, the Mod module can be unloaded or the massban command can be disabled. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for red-discordbot →
FAQ
Red Discord Bot is a Python-based open-source bot for the Discord chat platform. It provides various features and modules to enhance the functionality of Discord servers.
The Mod module in Red Discord Bot allows users with high privilege levels within a guild to moderate and manage the server.
The vulnerability allows unauthorized privilege escalation, enabling users to bypass hierarchy checks and perform destructive actions within the guild they have high privileges in.
The vulnerability can be mitigated by unloading the Mod module or disabling the massban command. However, it is recommended to update Red Discord Bot to version 3.4.1 or later to fully patch the issue.
You can find more information about the vulnerability in the Red Discord Bot advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/red-discordbot/PYSEC-2020-267.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for red-discordbot.
