CVE-2020-26249 Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability
Attackers can achieve remote code execution via XSS in Red Discord Bot Dashboard by crafting malicious server or user names, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26249?
CVE-2020-26249 is a high-severity cross-site scripting vulnerability in Cog-Creators Red-Dashboard, published on 8 Dec 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
Weakness: CWE-79
Which versions are affected by CVE-2020-26249?
3 open source packages ship an affected version, including red-dashboard. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
red-dashboard PyPI | All versions | 0.1.7a |
red-dashboard PyPI | All versions | 0.1.7a |
red-dashboard PyPI | All versions | 0.1.7a |
Products include Cogboard Red-Dashboard.
How do I fix CVE-2020-26249?
Upgrade red-dashboard to 0.1.7a or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-26249 being exploited?
There is no known exploitation of CVE-2020-26249 in the wild and no public exploit code.
Sources
Also known as GHSA-hm45-mgqm-gjm4, PYSEC-2020-98.