CVE-2024-43404

moderate-risk

Published 2024-08-20

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

Do I need to act?

4.3% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: 26c7b95ddbf5d762cad387f20b85fe3bd4fbb821

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Megabot

Affected Vendors

Megacord

References (5)

Patch https://github.com/NicPWNs/MEGABOT/commit/71e79e5581ea36313700385b112d863053fb7e...

Issue Tracking https://github.com/NicPWNs/MEGABOT/issues/137

Issue Tracking https://github.com/NicPWNs/MEGABOT/pull/138

Release Notes https://github.com/NicPWNs/MEGABOT/releases/tag/v1.5.0

Patch https://github.com/NicPWNs/MEGABOT/security/advisories/GHSA-vhxp-4hwq-w3p2

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 8/34 · Low

Exposure 5/34 · Minimal