CVE-2024-39905: Red-DiscordBot vulnerable to Incorrect Authorization in commands API
Due to a bug in Red’s Core API, 3rd-party cogs using the @commands.can_manage_channel() command permission check without additional permission controls may authorize a user to run a command even when that user doesn’t have permissions to manage a channel.
None of the core commands or core cogs are affected. The maintainers of the project are not aware of any public 3rd-party cog utilizing this API at the time of writing this advisory.
The @commands.mod_or_can_manage_channel(), @commands.admin_or_can_manage_channel(), and @commands.guildowner_or_can_manage_channel() command permission checks are unaffected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:Y/R:U/RE:L
References
- github.com/Cog-Creators/Red-DiscordBot
- github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750
- github.com/Cog-Creators/Red-DiscordBot/pull/6398
- github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4
- github.com/advisories/GHSA-5jq8-q6rj-9gq4
- nvd.nist.gov/vuln/detail/CVE-2024-39905
Code Behaviors & Features
Detect and mitigate CVE-2024-39905 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →