CVE-2020-15172 Remote Code Execution in Act module
Remote code execution in the Act module allows Discord users to execute arbitrary commands via crafted messages, requiring module unloading or patching.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-15172?
CVE-2020-15172 is a high-severity unsafe deserialization vulnerability in zephyrkul FluffyCogs, published on 15 Sep 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module with `unload act` can render this exploit inaccessible.
Weakness: CWE-502
Which versions are affected by CVE-2020-15172?
It affects 1 product.
Products include Fluffycogs Project Fluffycogs.
How do I fix CVE-2020-15172?
No fix has been published for CVE-2020-15172 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-15172 being exploited?
There is no known exploitation of CVE-2020-15172 in the wild and no public exploit code.
Sources
Also known as GHSA-rm7m-j4xp-rv2p.