PT-2020-16376 · Discord · Red Discord Bot

Published 2020-12-08 · Updated 2020-12-10 · CVE-2020-26249

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Red Discord Bot versions prior to 0.1.7a

Description A remote code execution (RCE) exploit has been discovered in the Red Discord Bot Dashboard, allowing Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. This exploit can be used to perform destructive actions and/or access sensitive information.

Recommendations For versions prior to 0.1.7a, upgrade the relevant packages (Dashboard module and Dashboard webserver) to version 0.1.7a to patch this issue. There are no workarounds, and bot owners must upgrade to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26249

GHSA-HM45-MGQM-GJM4

PYSEC-2020-98

Affected Products

Red Discord Bot

References · 12

• https://github.com/Cog-Creators/Red-Dashboard/commit/a6b9785338003ec87fb75305e7d1cc2d40c7ab91 · Patch
• https://github.com/Cog-Creators/Red-Dashboard/security/advisories/GHSA-hm45-mgqm-gjm4 · Patch
• https://github.com/Cog-Creators/Red-Dashboard/commit/99d88b840674674166ce005b784ae8e31e955ab1 · Patch
• https://osv.dev/vulnerability/GHSA-hm45-mgqm-gjm4 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26249 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26249 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/red-dashboard/PYSEC-2020-98.yaml · Note
• https://github.com/Cog-Creators/Red-Dashboard · Note
• https://t.me/cibsecurity/17461 · Telegram Post
• https://t.me/cvenotify/6796 · Telegram Post
• https://pypi.org/project/Red-Dashboard · Note