CVE-2024-21663

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21663
Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a Patch
https://github.com/DEMON1A/Discord-Recon/issues/23 Exploit Issue Tracking Third Party Advisory
https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 Exploit Patch Vendor Advisory
https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a Patch
https://github.com/DEMON1A/Discord-Recon/issues/23 Exploit Issue Tracking Third Party Advisory
https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:demon1a:discord-recon:*:*:*:*:*:discord:*:*
cpe:2.3:a:demon1a:discord-recon:0.0.8:beta:*:*:*:discord:*:*
History

21 Nov 2024, 08:54

Type Values Removed Values Added
References () https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a - Patch () https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a - Patch
References () https://github.com/DEMON1A/Discord-Recon/issues/23 - Exploit, Issue Tracking, Third Party Advisory () https://github.com/DEMON1A/Discord-Recon/issues/23 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 - Exploit, Patch, Vendor Advisory () https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 - Exploit, Patch, Vendor Advisory
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 9.9

12 Jan 2024, 15:22

Type Values Removed Values Added
First Time Demon1a
Demon1a discord-recon
CVSS v2 : unknown
v3 : 9.9 		v2 : unknown
v3 : 8.8
References () https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a - () https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a - Patch
References () https://github.com/DEMON1A/Discord-Recon/issues/23 - () https://github.com/DEMON1A/Discord-Recon/issues/23 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 - () https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7 - Exploit, Patch, Vendor Advisory
CWE CWE-77
CPE cpe:2.3:a:demon1a:discord-recon:*:*:*:*:*:discord:*:*
cpe:2.3:a:demon1a:discord-recon:0.0.8:beta:*:*:*:discord:*:*

09 Jan 2024, 14:01

Type Values Removed Values Added
Summary
  • (es) Discord-Recon es un bot de Discord creado para automatizar el reconocimiento de errores, escaneos automatizados y recopilación de información a través de un servidor de Discord. Discord-Recon es vulnerable a la ejecución remota de código. Un atacante puede ejecutar comandos de shell en el servidor sin tener una función de administrador. Esta vulnerabilidad se ha solucionado en la versión 0.0.8.

09 Jan 2024, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-09 00:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21663

Mitre link : CVE-2024-21663

CVE.ORG link : CVE-2024-21663

JSON object : View

Products Affected

demon1a

  • discord-recon
CWE
CWE-20

Improper Input Validation

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')