PT-2024-26400 · Mit · Mit Identibot

Zelnickb · Published 2024-05-27 · Updated 2024-05-28 · CVE-2024-35237

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MIT IdentiBot versions prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e

Description A vulnerability in MIT IdentiBot, an open-source Discord bot, allows unauthorized access to sensitive information about Discord users who have verified their affiliation with MIT. The issue arises because IdentiBot does not check if a server is authorized before allowing members to execute certain commands, such as /kerbid, which can reveal a user's full name and other information. This vulnerability affects instances of IdentiBot tied to a "public" Discord application that have not been patched. The estimated number of potentially affected devices or users is not specified.

Recommendations To prevent exploitation of the vulnerability, all vulnerable instances of MIT IdentiBot should be taken offline until they have been updated to the latest version, which contains a patch for this issue, implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e. As a temporary workaround, consider disabling the execution of slash and user commands in unauthorized servers until the patch is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-35237

GHSA-H8R9-7R8X-78V6

Affected Products

Mit Identibot

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35237.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-35237 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35237 · Vendor Advisory
• https://github.com/ZelnickB/mit-identibot/security/advisories/GHSA-h8r9-7r8x-78v6 · Note
• https://github.com/ZelnickB/mit-identibot/commit/48e3e5e7ead6777fa75d57c7711c8e55b501c24e · Note
• https://t.me/cvenotify/81092 · Telegram Post