PT-2024-31560 · Sudobot · Sudobot

Algerization · Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-45307

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SudoBot versions prior to 9.26.7

Description SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the -config command. This issue allows anyone to theoretically update any configuration of the bot and potentially gain control over the bot's settings.

Recommendations For versions prior to 9.26.7, upgrade to version 9.26.7 to receive a patch. As a temporary workaround, create a command permission overwrite in the Database by executing a provided SQL statement, replacing <guild id> with the appropriate Guild ID for each server the bot is in, to disallow users without ManageGuild permission to run the -config command.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2024-45307

GHSA-CRGG-W3RR-R9H4

Affected Products

Sudobot

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45307.json · Exploit
• https://github.com/onesoft-sudo/sudobot/commit/ef46ca98562f3c1abef4ff7dd94d8f7b8155ee50 · Patch
• https://github.com/onesoft-sudo/sudobot/security/advisories/GHSA-crgg-w3rr-r9h4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45307 · Security Note
• https://t.me/cvedetector/4709 · Telegram Post
• https://twitter.com/CVEnew/status/1831050584658513951 · Twitter Post
• https://twitter.com/CveFindCom/status/1831052415707025637 · Twitter Post
• https://twitter.com/cracbot/status/1832660233535287646 · Twitter Post