-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net.dv8tion:JDA | maven | >= 6.0.0, < 6.1.3 | 6.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in how JDA handles media URLs in message components. When a message component containing media (like a thumbnail, file display, or media gallery) is resent or updated, JDA would attempt to download the media from the URL specified in the component. The vulnerability lies in the getFilesFromMedia function within ComponentsUtil, which, before the patch, would download content from any URL provided in a ResolvedMedia object without verifying if it was a legitimate Discord attachment. An attacker could craft a message with a component pointing to an external, malicious URL. When a bot using the vulnerable JDA version processes this component (e.g., by using Message#getComponents and then resending them), JDA would make a request to the malicious URL, leading to a Server-Side Request Forgery (SSRF) vulnerability. The patch fixes this by adding a check (media.getAttachmentId() != null) to ensure that only media from Discord attachments are downloaded. The toData methods in FileDisplayImpl, MediaGalleryItemImpl, and ThumbnailImpl were also patched to use a new utility method (ComponentsUtil.getMediaUrl) that correctly handles media URLs, preventing the inclusion of external URLs in the component data sent to Discord's API.
net.dv8tion.jda.internal.components.utils.ComponentsUtil.getFilesFromMediasrc/main/java/net/dv8tion/jda/internal/components/utils/ComponentsUtil.java
net.dv8tion.jda.internal.components.filedisplay.FileDisplayImpl.toDatasrc/main/java/net/dv8tion/jda/internal/components/filedisplay/FileDisplayImpl.java
net.dv8tion.jda.internal.components.mediagallery.MediaGalleryItemImpl.toDatasrc/main/java/net/dv8tion/jda/internal/components/mediagallery/MediaGalleryItemImpl.java
net.dv8tion.jda.internal.components.thumbnail.ThumbnailImpl.toDatasrc/main/java/net/dv8tion/jda/internal/components/thumbnail/ThumbnailImpl.java
A Semantic Attack on Google Gemini - Read the Latest Research