PT-2024-19005 · Unknown · Discord-Recon

Micro0X00 · Published 2024-01-08 · Updated 2024-01-12 · CVE-2024-21663

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discord-Recon versions prior to 0.0.8

Description Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans, and information gathering via a Discord server. It is vulnerable to remote code execution, allowing an attacker to execute shell commands in the server without having an admin role.

Recommendations For versions prior to 0.0.8, update to version 0.0.8 to resolve the issue. As a temporary workaround, consider restricting access to the Discord server or disabling the bot until the update can be applied.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

CVE-2024-21663

GHSA-FJCJ-G7X8-4RP7

Affected Products

Discord-Recon

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21663.json · Exploit
• 🔥 https://github.com/DEMON1A/Discord-Recon/issues/23 · Exploit
• 🔥 https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 · Exploit
• https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a · Patch
• https://osv.dev/vulnerability/CVE-2024-21663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21663 · Security Note
• https://twitter.com/CVEnew/status/1744541366728704450 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1744532207421522186 · Twitter Post
• https://t.me/cvenotify/66693 · Telegram Post
• https://t.me/cvenotify/67249 · Telegram Post