onesoft-sudo sudobot up to 9.26.6 improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in onesoft-sudo sudobot up to 9.26.6. Impacted is an unknown function. The manipulation leads to improper authorization. This vulnerability is listed as CVE-2024-45307. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in onesoft-sudo sudobot up to 9.26.6 and classified as critical. This issue affects an unknown code. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretically able to update any configuration of the bot and potentially gain control over the bot's settings. Every version of v9 before v9.26.7 is affected. Other versions (e.g. v8) are not affected. Users should upgrade to version 9.26.7 to receive a patch. A workaround would be to create a command permission overwrite in the Database. A SQL statement provided in the GitHub Security Advisor can be executed to create a overwrite that disallows users without `ManageGuild` permission to run the `-config` command. Run the SQL statement for every server the bot is in, and replace `` with the appropriate Guild ID each time.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-45307 since 08/26/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 9.26.7 eliminates this vulnerability. Applying the patch ef46ca98562f3c1abef4ff7dd94d8f7b8155ee50 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System Utility Software

Vendor

• onesoft-sudo

Name

• sudobot

Version

• 9.26.0
• 9.26.1
• 9.26.2
• 9.26.3
• 9.26.4
• 9.26.5
• 9.26.6

License

• open-source

Website

• Product: https://github.com/onesoft-sudo/sudobot/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion