Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-36024

CVE-2022-36024: Bots using py-cord as Discord API wrapper are vulnerable to shutdowns through remote code execution

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-36024
GHSA ID
GHSA-qmhj-m29v-gvmr
EPSS Score
0.24258%
CWE
CWE-284
Published
8/18/2022
Updated
11/26/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
py-cordpip= 2.0.02.0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how interaction data was processed in applications without the 'bot' scope. The pull request #1568 shows critical changes to the Interaction._from_data method, specifically adding fallbacks for missing guild data and using Object() when guild information isn't properly scoped. This matches the CWE-284 (Improper Access Control) description, as the original implementation failed to properly validate/handle interaction context from unauthorized scopes, enabling remote shutdowns via malformed interactions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t py-*or* is * *n *PI wr*pp*r *or *is*or* writt*n in Pyt*on. *ots usin* py-*or* v*rsion *.*.* *r* vuln*r**l* to r*mot* s*ut*own i* t**y *r* ***** to t** s*rv*r wit* t** `*ppli**tion.*omm*n*s` s*op* wit*out t** `*ot` s*op*. *urr*ntly, it *pp*

Reasoning

T** vuln*r**ility st*ms *rom *ow int*r**tion **t* w*s pro**ss** in *ppli**tions wit*out t** '*ot' s*op*. T** pull r*qu*st #**** s*ows *riti**l ***n**s to t** Int*r**tion._*rom_**t* m*t*o*, sp**i*i**lly ***in* **ll***ks *or missin* *uil* **t* *n* usin