CVE-2024-43404 CRITICAL

CVE-2024-43404: Remote Code Execution Vulnerability in MEGABOT

Vendor Nicpwns
Product MEGABOT
Weakness CWE-95 · Eval injection
Published August 20, 2024
Last update August 20, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python code into the `expression` parameter when using `/math` in any Discord channel. This vulnerability impacts any discord guild utilizing MEGABOT. This vulnerability was fixed in release version 1.5.0.

Key dates

02Disclosure timeline

August 20, 2024 CVE published
August 20, 2024 Record updated