ZelnickB mit-identibot authorization

Summaryinfo

A vulnerability labeled as problematic has been found in ZelnickB mit-identibot. The affected element is an unknown function. Such manipulation leads to authorization. This vulnerability is referenced as CVE-2024-35237. It is possible to launch the attack remotely. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in ZelnickB mit-identibot (the affected version unknown) and classified as problematic. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a "public" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To prevent exploitation of the vulnerability, all vulnerable instances of IdentiBot should be taken offline until they have been updated.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-35237 since 05/14/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Applying the patch 48e3e5e7ead6777fa75d57c7711c8e55b501c24e is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• ZelnickB

Name

• mit-identibot

License

• open-source

Website

• Product: https://github.com/ZelnickB/mit-identibot/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion