PT-2024-18976 · Nonebot2 · Nonebot2

Mnixry · Published 2024-02-09 · Updated 2024-03-03 · CVE-2024-21624

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nonebot2 versions prior to 2.2.0

Description This issue pertains to a potential information leak, such as environment variables, when developers use MessageTemplate and incorporate user-provided data into templates. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of MessageTemplate and incorporation of user-provided data into templates, which can lead to information leaks.

Recommendations For nonebot2 versions prior to 2.2.0, upgrade to version 2.2.0 or later to safeguard against the vulnerability. As a temporary workaround, consider filtering underscores before incorporating user input into the MessageTemplate to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-1336

CWE-200

Related Identifiers

CVE-2024-21624

GHSA-59J8-776V-XXXG

PYSEC-2024-37

Affected Products

Nonebot2

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21624.json · Exploit
• https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg · Vendor Advisory
• https://github.com/nonebot/nonebot2/pull/2509 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21624 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21624 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-37 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59j8-776v-xxxg · Vendor Advisory
• https://github.com/nonebot/nonebot2/commit/b65b3b438c95894654fd9081139989c757bdc6c1 · Note
• https://github.com/nonebot/nonebot2 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nonebot2/PYSEC-2024-37.yaml · Note
• https://t.me/cvenotify/70891 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1756129008125723087 · Twitter Post
• https://twitter.com/CVEnew/status/1756083190974808106 · Twitter Post
• https://t.me/cvenotify/71711 · Telegram Post
• https://twitter.com/Esparta6108713/status/1764323036222656528 · Twitter Post