NicPWNs MEGABOT up to 1.4.x /math eval expression eval injection

Summaryinfo

A vulnerability was found in NicPWNs MEGABOT up to 1.4.x. It has been rated as very critical. Affected by this vulnerability is the function eval of the file /math. This manipulation of the argument expression causes eval injection. This vulnerability is registered as CVE-2024-43404. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as very critical was found in NicPWNs MEGABOT up to 1.4.x. Affected by this vulnerability is the function eval of the file /math. The manipulation of the argument expression with an unknown input leads to a eval injection vulnerability. The CWE definition for the vulnerability is CWE-95. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-43404 since 08/12/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/27/2024).

Upgrading to version 1.5.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 71e79e5581ea36313700385b112d863053fb7ed6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• NicPWNs

Name

• MEGABOT

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4

License

• open-source

Website

• Product: https://github.com/NicPWNs/MEGABOT/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion