CVE-2024-21624

Potential information leak in MessageTemplate with user input in nonebot2.

• CVSS 6.5
• CWE-200
• Information Leakage
• Remote

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.

CVE

CVE-2024-21624

CWE

CWE-200

CVSS base score

6.5

Published

2024-02-09

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Interface

Code defect classification

Missing Check

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

nonebot2

Fixed by upgrading

Yes

Solution

Upgrade to version 2.2.0 or later.

from nonebot import MessageTemplate

user_input = "User 's secret: ${SECRET_ENV_VAR}"

template = MessageTemplate("Here is your message: {message}")
message = template.render(message=user_input)

print(message)

from nonebot import MessageTemplate

user_input = "User 's secret: ${SECRET_ENV_VAR}"

replaced_input = user_input.replace("_", "")

template = MessageTemplate("Here is your message: {message}")
message = template.render(message=replaced_input)

print(message)

"${SECRET_ENV_VAR}"

@misc{vaitp:cve202421624,
  title        = {{Potential information leak in MessageTemplate with user input in nonebot2.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21624},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21624/}}
}