CVE-2024-39905: Insufficient Information (NVD-CWE-noinfo)
value: Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-11T16:15Z
Repository: https://github.com/Cog-Creators/Red-DiscordBot
Language: Python
Files changed: redbot/core/commands/requires.py
Commit date: 2024-07-10 20:41:24 +0200
Commit message: Fix `@commands.can_manage_channel` always passing (#6398)


Diff: diff --git a/redbot/core/commands/requires.py b/redbot/core/commands/requires.py
index b5526a671..9a94bd03d 100644
--- a/redbot/core/commands/requires.py
+++ b/redbot/core/commands/requires.py
@@ -759,11 +759,11 @@ def bot_can_react() -> Callable[[_T], _T]:
 
     return decorator
 
 
 def _can_manage_channel_deco(
-    privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
+    *, privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
 ) -> Callable[[_T], _T]:
     async def predicate(ctx: "Context") -> bool:
         if utils.can_user_manage_channel(
             ctx.author, ctx.channel, allow_thread_owner=allow_thread_owner
         ):
@@ -801,11 +801,11 @@ def can_manage_channel(*, allow_thread_owner: bool = False) -> Callable[[_T], _T
         If ``True``, the command will also be allowed to run if the author is a thread owner.
         This can, for example, be useful to check if the author can edit a channel/thread's name
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(allow_thread_owner)
+    return _can_manage_channel_deco(allow_thread_owner=allow_thread_owner)
 
 
 def is_owner():
     """Restrict the command to bot owners.
 
@@ -835,11 +835,13 @@ def guildowner_or_can_manage_channel(*, allow_thread_owner: bool = False) -> Cal
         If ``True``, the command will also be allowed to run if the author is a thread owner.
         This can, for example, be useful to check if the author can edit a channel/thread's name
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(PrivilegeLevel.GUILD_OWNER, allow_thread_owner)
+    return _can_manage_channel_deco(
+        privilege_level=PrivilegeLevel.GUILD_OWNER, allow_thread_owner=allow_thread_owner
+    )
 
 
 def guildowner():
     """Restrict the command to the guild owner.
 
@@ -869,11 +871,13 @@ def admin_or_can_manage_channel(*, allow_thread_owner: bool = False) -> Callable
         If ``True``, the command will also be allowed to run if the author is a thread owner.
         This can, for example, be useful to check if the author can edit a channel/thread's name
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(PrivilegeLevel.ADMIN, allow_thread_owner)
+    return _can_manage_channel_deco(
+        privilege_level=PrivilegeLevel.ADMIN, allow_thread_owner=allow_thread_owner
+    )
 
 
 def admin():
     """Restrict the command to users with the admin role.
 
@@ -903,11 +907,13 @@ def mod_or_can_manage_channel(*, allow_thread_owner: bool = False) -> Callable[[
         If ``True``, the command will also be allowed to run if the author is a thread owner.
         This can, for example, be useful to check if the author can edit a channel/thread's name
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(PrivilegeLevel.MOD, allow_thread_owner)
+    return _can_manage_channel_deco(
+        privilege_level=PrivilegeLevel.MOD, allow_thread_owner=allow_thread_owner
+    )
 
 
 def mod():
     """Restrict the command to users with the mod role.
 

Vulnerable code:     privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
    return _can_manage_channel_deco(allow_thread_owner)
    return _can_manage_channel_deco(PrivilegeLevel.GUILD_OWNER, allow_thread_owner)
    return _can_manage_channel_deco(PrivilegeLevel.ADMIN, allow_thread_owner)
    return _can_manage_channel_deco(PrivilegeLevel.MOD, allow_thread_owner)
Fixed code:     *, privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
    return _can_manage_channel_deco(allow_thread_owner=allow_thread_owner)
    return _can_manage_channel_deco(
        privilege_level=PrivilegeLevel.GUILD_OWNER, allow_thread_owner=allow_thread_owner
    )
    return _can_manage_channel_deco(
        privilege_level=PrivilegeLevel.ADMIN, allow_thread_owner=allow_thread_owner
    )
    return _can_manage_channel_deco(
        privilege_level=PrivilegeLevel.MOD, allow_thread_owner=allow_thread_owner
    )