CVE-2022-36024 Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code execution
Attackers can shut down Discord bots by exploiting missing authorization checks when the bot is added with specific scopes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36024?
CVE-2022-36024 is a high-severity missing authorization vulnerability in Pycord-Development pycord, published on 18 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the `application.commands` scope without the `bot` scope. Currently, it appears that all public bots that use slash commands are affected. This issue has been patched in version 2.0.1. There are currently no recommended workarounds - please upgrade to a patched version.
Which versions are affected by CVE-2022-36024?
3 open source packages ship an affected version, including py-cord. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
py-cord PyPI | From 2.0.0 | 2.0.1 |
py-cord PyPI | From 2.0.0 | 2.0.1 |
py-cord PyPI | From 2.0.0 | 2.0.1 |
Products include Pycord Development Pycord.
How do I fix CVE-2022-36024?
Upgrade py-cord to 2.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-36024 being exploited?
There is no known exploitation of CVE-2022-36024 in the wild and no public exploit code.
Sources
Also known as GHSA-qmhj-m29v-gvmr, PYSEC-2022-43146.