CVE-2024-45307 SudoBot missing authorization check in `-config` command
Attackers can modify bot configuration settings without proper authorization, potentially gaining control over the bot's behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-45307?
CVE-2024-45307 is a high-severity missing authorization vulnerability in onesoft-sudo sudobot, published on 3 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SudoBot, a Discord moderation bot, is vulnerable to privilege escalation and exploit of the `-config` command in versions prior to 9.26.7. Anyone is theoretically able to update any configuration of the bot and potentially gain control over the bot's settings. Every version of v9 before v9.26.7 is affected. Other versions (e.g. v8) are not affected. Users should upgrade to version 9.26.7 to receive a patch. A workaround would be to create a command permission overwrite in the Database. A SQL statement provided in the GitHub Security Advisor can be executed to create a overwrite that disallows users without `ManageGuild` permission to run the `-config` command. Run the SQL statement for every server the bot is in, and replace `<guild_id>` with the appropriate Guild ID each time.
Which versions are affected by CVE-2024-45307?
It affects 1 product.
Products include Onesoftnet Sudobot.
How do I fix CVE-2024-45307?
No fix has been published for CVE-2024-45307 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-45307 being exploited?
There is no known exploitation of CVE-2024-45307 in the wild and no public exploit code.
Sources
Also known as GHSA-crgg-w3rr-r9h4.