CVE-2024-31442: Insufficient Information (NVD-CWE-noinfo)
value: Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-08T16:15Z
Repository: https://github.com/Redon-Tech/Redon-Hub
Language: Python
Files changed: bot/__init__.py, bot/cogs/product.py, bot/cogs/tag.py, bot/cogs/user.py
Commit date: 2024-04-06 22:34:43 -1000
Commit message: V1.0.2

Diff: diff --git a/bot/__init__.py b/bot/__init__.py
index d94b442..ebe33bb 100644
--- a/bot/__init__.py
+++ b/bot/__init__.py
@@ -1,28 +1,32 @@
 """
     File: /bot/__init__.py
     Usage: The bot's main file.
 """
 
-from discord import Object as DiscordObject
+from discord import Interaction, Embed
 from discord.ext.commands import Bot as BotBase
+from discord.app_commands import AppCommandError, MissingPermissions
 from . import config
 from .data import database
 from glob import glob
 import logging
 import os
+import datetime
 
 _log = logging.getLogger(__name__)
-__version__ = "1.0.0"
+__version__ = "1.0.2"
 
 
 class Bot(BotBase):
     def __init__(self, *args, **kwargs):
         self.version = kwargs.get("version", "N/A")
         self.ready = False
         super().__init__(*args, **kwargs)
 
+        self.tree.on_error = self.on_app_command_error
+
     async def load_extensions(self):
         # Original code from pycord
 
         cogs = [
             path.split(os.sep)[-1][:-3]
@@ -52,5 +56,20 @@ class Bot(BotBase):
             _log.info(f"Bot Online | {self.user} | {self.user.id}")
 
             await database.connect()
 
             _log.info("Database Connected")
+
+    async def on_app_command_error(
+        self, interaction: Interaction, error: AppCommandError
+    ):
+        if isinstance(error, MissingPermissions):
+            await interaction.response.send_message(
+                embed=Embed(
+                    title="Error",
+                    description="You are not allowed to use this command.",
+                    colour=interaction.user.colour,
+                    timestamp=datetime.datetime.now(datetime.timezone.utc),
+                ).set_footer(text=f"Redon Hub • Version {self.version}"),
+            )
+
+        _log.error(error)
diff --git a/bot/cogs/product.py b/bot/cogs/product.py
index 7ed5e04..ff46a24 100644
--- a/bot/cogs/product.py
+++ b/bot/cogs/product.py
@@ -1,28 +1,28 @@
 """
     File: /bot/cogs/product.py
     Usage: Product related commands
 """
+
 from discord import (
     app_commands,
     Interaction,
-    Member,
     Embed,
     utils,
     ui,
     TextStyle,
     SelectOption,
     ButtonStyle,
     Role,
 )
+from discord.app_commands import MissingPermissions
 from asyncio import TimeoutError
 from discord.ext.commands import Cog
 from bot.data import (
     get_users,
     get_products,
     get_product_by_name,
-    get_product,
     create_product,
     delete_product,
     get_tags,
     Product,
 )
@@ -815,11 +815,10 @@ class ProductCog(Cog):
 
     product_admin = app_commands.Group(
         name="admin",
         description="Product Admin Commands",
         parent=product_commands,
-        default_permissions=None,
     )
 
     @app_commands.command(
         name="products", description="View all the products this server has"
     )
@@ -891,10 +890,11 @@ class ProductCog(Cog):
         ]
 
     @product_admin.command(
         name="stats", description="Get statistics on a specific product"
     )
+    @app_commands.checks.has_permissions(administrator=True)
     async def get_product_stats_info_command(
         self, interaction: Interaction, product_name: str
     ):
         try:
             product = await get_product_by_name(product_name)
@@ -937,14 +937,16 @@ class ProductCog(Cog):
             for product in products
             if current_product_name.lower() in product.name.lower()
         ]
 
     @product_admin.command(name="create", description="Create a new product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def create_product_command(self, interaction: Interaction):
         await interaction.response.send_modal(createProduct(bot=self.bot))
 
     @product_admin.command(name="delete", description="Delete a product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def delete_product_command(self, interaction: Interaction, product_name: str):
         try:
             product = await get_product_by_name(product_name)
         except Exception:
             product = None
@@ -1031,21 +1033,23 @@ class ProductCog(Cog):
             for product in products
             if current_product_name.lower() in product.name.lower()
         ]
 
     @product_admin.command(name="clear", description="Delete all products")
+    @app_commands.checks.has_permissions(administrator=True)
     async def clear_products_command(self, interaction: Interaction):
         if interaction.user.id not in config.Bot.Owners:
-            await interaction.response.send_message(
-                embed=Embed(
-                    title="Error",
-                    description="You are not allowed to use this command.",
-                    colour=interaction.user.colour,
-                    timestamp=utils.utcnow(),
-                ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
-            )
-            return
+            # await interaction.response.send_message(
+            #     embed=Embed(
+            #         title="Error",
+            #         description="You are not allowed to use this command.",
+            #         colour=interaction.user.colour,
+            #         timestamp=utils.utcnow(),
+            #     ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
+            # )
+            # return
+            raise MissingPermissions("Bot Owner")
 
         try:
             products = await get_products()
         except Exception:
             products = []
@@ -1112,10 +1116,11 @@ class ProductCog(Cog):
                     timestamp=utils.utcnow(),
                 ).set_footer(text=f"Redon Hub • Version {self.bot.version}")
             )
 
     @product_admin.command(name="update", description="Update a product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def update_product_command(self, interaction: Interaction, product_name: str):
         await interaction.response.defer()
 
         try:
             product = await get_product_by_name(product_name)
diff --git a/bot/cogs/tag.py b/bot/cogs/tag.py
index 91d15eb..1d2e98c 100644
--- a/bot/cogs/tag.py
+++ b/bot/cogs/tag.py
@@ -1,18 +1,17 @@
 """
     File: /bot/cogs/tags.py
     Usage: Tag related commands
 """
+
 from discord import (
     app_commands,
     Interaction,
     Embed,
     utils,
     ui,
-    TextStyle,
     SelectOption,
-    ButtonStyle,
 )
 from discord.ext.commands import Cog
 from bot.data import get_tag, get_tag_by_name, get_tags, create_tag, delete_tag, Tag
 from PIL import ImageColor
 import logging
@@ -190,11 +189,10 @@ class TagCog(Cog):
     tag_commands = app_commands.Group(name="tag", description="Tag Commands")
     tag_admin = app_commands.Group(
         name="admin",
         description="Tag Admin Commands",
         parent=tag_commands,
-        default_permissions=None,
     )
 
     @app_commands.command(name="tags", description="View all the tags this server has")
     async def get_tags_command(self, interaction: Interaction):
         await interaction.response.defer()
@@ -258,14 +256,16 @@ class TagCog(Cog):
             for tag in tags
             if current_tag_name.lower() in tag.name.lower()
         ]
 
     @tag_admin.command(name="create", description="Create a new tag")
+    @app_commands.checks.has_permissions(administrator=True)
     async def create_tag_command(self, interaction: Interaction):
         await interaction.response.send_modal(createTag(bot=self.bot))
 
     @tag_admin.command(name="delete", description="Delete a tag")
+    @app_commands.checks.has_permissions(administrator=True)
     async def delete_tag_command(self, interaction: Interaction):
         await interaction.response.defer()
 
         tags = await get_tags()
 
@@ -278,10 +278,11 @@ class TagCog(Cog):
             ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
             view=deleteTagView(tags, bot=self.bot),
         )
 
     @tag_admin.command(name="update", description="Update a tag")
+    @app_commands.checks.has_permissions(administrator=True)
     async def update_tag_command(self, interaction: Interaction, tag_name: str):
         try:
             tag = await get_tag_by_name(tag_name)
         except Exception:
             tag = None
diff --git a/bot/cogs/user.py b/bot/cogs/user.py
index c05eb09..ed7555c 100644
--- a/bot/cogs/user.py
+++ b/bot/cogs/user.py
@@ -1,10 +1,18 @@
 """
     File: /bot/cogs/user.py
     Usage: User related commands
 """
-from discord import app_commands, Interaction, Member, Embed, utils, Forbidden
+
+from discord import (
+    app_commands,
+    Interaction,
+    Member,
+    Embed,
+    utils,
+    Forbidden,
+)
 from discord.ext.commands import Cog
 from bot.data import (
     get_user_by_discord_id,
     get_product,
     get_product_by_name,
@@ -25,11 +33,10 @@ class User(Cog):
 
     user_admin = app_commands.Group(
         name="admin",
         description="User Admin Commands",
         parent=user_commands,
-        default_permissions=None,
     )
 
     @app_commands.command(name="profile", description="View a user's profile")
     async def user_profile(self, interaction: Interaction, member: Optional[Member]):
         member = member or interaction.user
@@ -389,10 +396,11 @@ class User(Cog):
             for product in products
             if current_product_name.lower() in product.name.lower()
         ]
 
     @user_admin.command(name="give", description="Give a user a product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_give(
         self, interaction: Interaction, product_name: str, member: Member
     ):
         await interaction.response.defer()
 
@@ -481,10 +489,11 @@ class User(Cog):
                     timestamp=utils.utcnow(),
                 ).set_footer(text=f"Redon Hub • Version {self.bot.version}")
             )
 
     @user_admin_give.autocomplete("product_name")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_give_autocomplete(
         self, interaction: Interaction, current_product_name: str
     ):
         try:
             products = await get_products()
@@ -496,10 +505,11 @@ class User(Cog):
             for product in products
             if current_product_name.lower() in product.name.lower()
         ]
 
     @user_admin.command(name="revoke", description="Revoke a product from a user")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_revoke(
         self, interaction: Interaction, product_name: str, member: Member
     ):
         await interaction.response.defer()
 
@@ -570,10 +580,11 @@ class User(Cog):
                     timestamp=utils.utcnow(),
                 ).set_footer(text=f"Redon Hub • Version {self.bot.version}")
             )
 
     @user_admin_revoke.autocomplete("product_name")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_revoke_autocomplete(
         self, interaction: Interaction, current_product_name: str
     ):
         try:
             products = await get_products()

Vulnerable code: from discord import Object as DiscordObject
__version__ = "1.0.0"
    Member,
    get_product,
        default_permissions=None,
            await interaction.response.send_message(
                embed=Embed(
                    title="Error",
                    description="You are not allowed to use this command.",
                    colour=interaction.user.colour,
                    timestamp=utils.utcnow(),
                ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
            )
            return
    TextStyle,
    ButtonStyle,
        default_permissions=None,
from discord import app_commands, Interaction, Member, Embed, utils, Forbidden
        default_permissions=None,
Fixed code: from discord import Interaction, Embed
from discord.app_commands import AppCommandError, MissingPermissions
import datetime
__version__ = "1.0.2"
        self.tree.on_error = self.on_app_command_error


    async def on_app_command_error(
        self, interaction: Interaction, error: AppCommandError
    ):
        if isinstance(error, MissingPermissions):
            await interaction.response.send_message(
                embed=Embed(
                    title="Error",
                    description="You are not allowed to use this command.",
                    colour=interaction.user.colour,
                    timestamp=datetime.datetime.now(datetime.timezone.utc),
                ).set_footer(text=f"Redon Hub • Version {self.version}"),
            )

        _log.error(error)

from discord.app_commands import MissingPermissions
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
            # await interaction.response.send_message(
            #     embed=Embed(
            #         title="Error",
            #         description="You are not allowed to use this command.",
            #         colour=interaction.user.colour,
            #         timestamp=utils.utcnow(),
            #     ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
            # )
            # return
            raise MissingPermissions("Bot Owner")
    @app_commands.checks.has_permissions(administrator=True)

    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)

from discord import (
    app_commands,
    Interaction,
    Member,
    Embed,
    utils,
    Forbidden,
)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)