discordrb encoder.rb File os command injection

Summaryinfo

A vulnerability was found in discordrb and classified as critical. Impacted is an unknown function of the file encoder.rb. The manipulation of the argument File results in os command injection. This vulnerability is known as CVE-2023-28102. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in discordrb (the affected version is unknown). Affected is an unknown code of the file encoder.rb. The manipulation of the argument file with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`.

The weakness was published 03/28/2023 as GHSL-2022-094. The advisory is available at securitylab.github.com. This vulnerability is traded as CVE-2023-28102 since 03/10/2023. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Applying the patch 91e13043ffa89227c3fcdc3408f06da237d28c95 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• discordrb

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion