CVE-2024-21663

Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a	Patch
https://github.com/DEMON1A/Discord-Recon/issues/23	Exploit Issue Tracking Third Party Advisory
https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7	Exploit Patch Vendor Advisory
https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a	Patch
https://github.com/DEMON1A/Discord-Recon/issues/23	Exploit Issue Tracking Third Party Advisory
https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:demon1a:discord-recon::::::discord::*
	cpe:2.3:a:demon1a:discord-recon:0.0.8:beta::::discord::*

History

21 Nov 2024, 08:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-09 00:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21663

Mitre link : CVE-2024-21663

CVE.ORG link : CVE-2024-21663

JSON object : View

Products Affected

demon1a

discord-recon

CWE

CWE-20

Improper Input Validation

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-21663", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-01-09T00:15:44.790", "references": [{"url": "https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/DEMON1A/Discord-Recon/issues/23", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/DEMON1A/Discord-Recon/issues/23", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.\n"}, {"lang": "es", "value": "Discord-Recon es un bot de Discord creado para automatizar el reconocimiento de errores, escaneos automatizados y recopilaci\u00f3n de informaci\u00f3n a trav\u00e9s de un servidor de Discord. Discord-Recon es vulnerable a la ejecuci\u00f3n remota de c\u00f3digo. Un atacante puede ejecutar comandos de shell en el servidor sin tener una funci\u00f3n de administrador. Esta vulnerabilidad se ha solucionado en la versi\u00f3n 0.0.8."}], "lastModified": "2024-11-21T08:54:49.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:demon1a:discord-recon:*:*:*:*:*:discord:*:*", "vulnerable": true, "matchCriteriaId": "C89EDC32-6EF6-4868-A4A5-911E552F82B8", "versionEndExcluding": "0.0.8"}, {"criteria": "cpe:2.3:a:demon1a:discord-recon:0.0.8:beta:*:*:*:discord:*:*", "vulnerable": true, "matchCriteriaId": "5EF620EA-979B-4367-903C-DC2BFAFCAD09"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}