CVE-2024-21624 Potential Information Leak in User-Constructed Message Templates in nonebot2
Attackers can leak sensitive data like environment variables if developers improperly use user input in message templates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-21624?
CVE-2024-21624 is a medium-severity vulnerability in nonebot2, published on 9 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.
Weakness: CWE-200
Which versions are affected by CVE-2024-21624?
3 open source packages ship an affected version, including nonebot2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nonebot2 PyPI | From 2.0.0a16 | 2.2.0 |
nonebot2 PyPI | From 2.0.0a16 | 2.2.0 |
nonebot2 PyPI | From 2.0.1 | 2.2.0 |
Products include Nonebot Nonebot.
How do I fix CVE-2024-21624?
Upgrade nonebot2 to 2.2.0 or later.
Is CVE-2024-21624 being exploited?
There is no known exploitation of CVE-2024-21624 in the wild and no public exploit code.
Sources
Also known as GHSA-59j8-776v-xxxg, PYSEC-2024-37.