CVE-2022-36024

py-cord 2.0.0 bots vulnerable to remote shutdown with application.commands scope

• CVSS 6.5
• CWE-862
• Design Defects
• Remote

py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the `application.commands` scope without the `bot` scope. Currently, it appears that all public bots that use slash commands are affected. This issue has been patched in version 2.0.1. There are currently no recommended workarounds – please upgrade to a patched version.

CVE

CVE-2022-36024

CWE

CWE-862

CVSS base score

6.5

Published

2022-08-18

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update py-cord to version 2.0.1 or higher.

import discord
from discord.ext import commands

bot = commands.Bot(command_prefix='!', intents=discord.Intents.default())

@bot.slash_command()
async def shutdown(ctx):
    await ctx.respond("Shutting down...")
    await bot.close()

bot.run('YOUR_TOKEN_HERE')

import discord
from discord.ext import commands

bot = commands.Bot(command_prefix='!', intents=discord.Intents.default())

@bot.slash_command()
async def shutdown(ctx):
    authorized_user_ids = [1234567890]
    
    if ctx.author.id not in authorized_user_ids:
        await ctx.respond("You do not have permission to use this command.", ephemeral=True)
        return

    await ctx.respond("Shutting down...")
    await bot.close()

bot.run('YOUR_TOKEN_HERE')

@misc{vaitp:cve202236024,
  title        = {{py-cord 2.0.0 bots vulnerable to remote shutdown with application.commands scope}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-36024},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-36024/}}
}