CVE-2024-43404

Remote code execution vulnerability in MEGABOT's `/math` command.

• CVSS 9.8
• CWE-94
• Input Validation and Sanitization
• Remote

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

CVE

CVE-2024-43404

CWE

CWE-94

CVSS base score

9.8

Published

2024-08-20

OWASP

A01 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

MEGABOT

Solution

Upgrade MEGABOT to version 1.5.0 or later.

def math_command(expression):
    """Vulnerable function that demonstrates the security issue."""
    result = eval(expression)
    return result

user_input = "2 + 2"
print(math_command(user_input))

import ast

def math_command(expression):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    result = ast.literal_eval(expression)
    return result

user_input = "2 + 2"
print(math_command(user_input))

__import__('os').system('ls')

@misc{vaitp:cve202443404,
  title        = {{Remote code execution vulnerability in MEGABOT's `/math` command.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-43404},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-43404/}}
}