PT-2024-24079 · Roblox · Redon Hub

Pulse-Design · Published 2024-04-08 · Updated 2026-01-07 · CVE-2024-31442

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redon Hub versions prior to 1.0.2

Description The issue affects Redon Hub, a Roblox Product Delivery Bot. In affected versions, all commands can be executed by all users, including admin commands. This allows users to receive products for free and perform actions such as deleting, creating, or updating products, tags, etc. The only command that is not affected is /products admin clear, as it was already restricted to bot owners. Users can upgrade to version 1.0.2 to receive a patch.

Recommendations For versions prior to 1.0.2, upgrade to version 1.0.2 to receive a patch. As a temporary workaround, consider restricting access to admin commands until the patch is applied. Avoid using vulnerable commands, except for the /products admin clear command, which is already secure.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-31442

GHSA-3RX8-6453-7Q26

Affected Products

Redon Hub

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31442.json · Exploit
• https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26 · Vendor Advisory
• https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd · Patch
• https://osv.dev/vulnerability/CVE-2024-31442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31442 · Security Note
• https://twitter.com/VulmonFeeds/status/1777406186393841976 · Twitter Post
• https://twitter.com/CVEnew/status/1777363313162371389 · Twitter Post
• https://twitter.com/cracbot/status/1777569292990534011 · Twitter Post
• https://t.me/cvenotify/76063 · Telegram Post
• https://t.me/cveNotify/147971 · Telegram Post