PT-2021-14503 · Unknown · Sopel-Channelmgnt

Rhinosf1 · Published 2021-04-09 · Updated 2022-10-24 · CVE-2021-21431

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions sopel-channelmgnt versions prior to 2.0.1

Description The issue concerns the sopel-channelmgnt plugin for sopel, where restrictions around the removal of the bot using the kick/kickban command could be bypassed on some IRC servers when kicking multiple users at once. It is also believed that it may have been possible to remove users from other channels, but due to the complexity of IRC and following RfCs, there is no proof of concept for this. Freenode is not affected.

Recommendations As a temporary workaround, do not use this plugin on networks where TARGMAX > 1. Upgrade to version 2.0.1 or higher to fix the issue.

Fix

Improper Access Control

RCE

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

CVE-2021-21431

GHSA-23C7-6444-399M

PYSEC-2021-58

Affected Products

Sopel-Channelmgnt

References · 12

• https://github.com/MirahezeBots/sopel-channelmgnt/commit/7c96d400358221e59135f0a0be0744f3fad73856 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-58 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-23c7-6444-399m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21431 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21431 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/sopel-plugins-channelmgnt/PYSEC-2021-58.yaml · Note
• https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-23c7-6444-399m · Note
• https://github.com/MirahezeBots/sopel-channelmgnt/commit/643388365f28c5cc682254ab913c401f0e53260a · Note
• https://github.com/MirahezeBots/sopel-channelmgnt · Note
• https://t.me/cvenotify/14010 · Telegram Post
• https://pypi.org/project/sopel-plugins.channelmgnt · Note
• https://t.me/cvenotify/13020 · Telegram Post