PT-2018-6234 · Discord · Discord.Js

Published 2018-06-07 · Updated 2019-10-09 · CVE-2017-16207

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: discordi.js versions (affected versions not specified)

Description: The issue concerns a malicious module named discordi.js, which is based on the discord.js library. This module is designed to exfiltrate login tokens to pastebin. It attempts to discover and exfiltrate a user's Discord credentials, sending them to pastebin. The estimated number of potentially affected devices worldwide is not available.

Recommendations: Do not install or use the discordi.js module. Any users that logged into Discord using this library will need to change their credentials.

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2017-16207

GHSA-FV9M-F7W4-889C

Affected Products

Discord.Js

References · 6

• https://osv.dev/vulnerability/CVE-2017-16207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16207 · Security Note
• https://osv.dev/vulnerability/GHSA-fv9m-f7w4-889c · Vendor Advisory
• https://npmjs.com/advisories/545 · Note
• https://nodesecurity.io/advisories/545 · Note
• https://github.com/advisories/GHSA-fv9m-f7w4-889c · Note