by Kastro
Paper/Archive/CVE-2024-21663

CVE-2024-21663

DEMON1A Discord-Recon — Remote code execution on ReconServer due to improper input sanitization on the prips command

EPSS 2%public exploitCVSS 10.0
critical.is priorityof 100
55
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 74.8.748 × 2015.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

Affected

ProductAffectedFixed inSource
Discord-Recon< 0.0.8–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7refgithub.com/DEMON1A/Discord-Recon/issues/23refgithub.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a