PT-2023-21560 · Discordrb · Discordrb

Erik Krogh Kristensen · Published 2023-03-27 · Updated 2024-03-14 · CVE-2023-28102

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions discordrb versions prior to commit 91e13043ffa

Description The discordrb library, an implementation of the Discord API using Ruby, has a command injection issue due to the unsafe construction of a shell string using the file parameter in the encoder.rb file. This can potentially leave clients of discordrb vulnerable to command injection if user input is passed to the vulnerable method. An attacker can execute arbitrary shell commands on the host machine, with the full impact depending on the permissions of the process running the discordrb library.

Recommendations For discordrb versions prior to commit 91e13043ffa, update the library to a version that includes the fix for this issue, once it is available. As a temporary workaround, consider restricting the use of the vulnerable method to minimize the risk of exploitation. Avoid passing user input to the vulnerable method in the encoder.rb file until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-28102

GHSA-8832-4MM5-X2R6

Affected Products

Discordrb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28102.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/discordrb/CVE-2023-28102.yml · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-094_discordrb · Exploit
• https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95 · Patch
• https://osv.dev/vulnerability/GHSA-8832-4mm5-x2r6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28102 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28102 · Vendor Advisory
• https://github.com/shardlab/discordrb · Note
• https://securitylab.github.com/advisories · Note
• https://t.me/cibsecurity/60857 · Telegram Post