CVE-2024-35237: Insufficient Information (NVD-CWE-noinfo)
value: MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a "public" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To prevent exploitation of the vulnerability, all vulnerable instances of IdentiBot should be taken offline until they have been updated.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-27T17:15Z
Repository: https://github.com/ZelnickB/mit-identibot
Language: JavaScript
Files changed: discordBot/commands/ChatInput/logic/kerbid.js, discordBot/commands/ChatInput/logic/resetnick.js, discordBot/commands/User/logic/Get Profile from Linked Kerberos.js	, discordBot/commands/serverAuthorization.js
Commit date: 2024-05-27 01:31:00 -0400
Commit message: Patched GHSA-h8r9-7r8x-78v6

This commit patches GHSA-h8r9-7r8x-78v6 by performing an authorization check (i.e., checking whether the server is registered) before the use of `/kerbid` and `/resetnick` (as well as the corresponding user commands).

Diff: diff --git a/discordBot/commands/ChatInput/logic/kerbid.js b/discordBot/commands/ChatInput/logic/kerbid.js
index 76d0a63..c89cdf2 100644
--- a/discordBot/commands/ChatInput/logic/kerbid.js
+++ b/discordBot/commands/ChatInput/logic/kerbid.js
@@ -1,8 +1,10 @@
 import { profileText } from '../../common/kerbid.js'
+import { authorizeAndReply } from '../../serverAuthorization.js'
 
 export default async function (interaction) {
+  if (!await authorizeAndReply(interaction)) return
   interaction.reply({
     content: await profileText(interaction.options.get('user').user),
     allowedMentions: {
       parse: []
     },
diff --git a/discordBot/commands/ChatInput/logic/resetnick.js b/discordBot/commands/ChatInput/logic/resetnick.js
index 881ab3c..6150eb1 100644
--- a/discordBot/commands/ChatInput/logic/resetnick.js
+++ b/discordBot/commands/ChatInput/logic/resetnick.js
@@ -1,8 +1,10 @@
 import { getNewNickname } from '../../common/resetnick.js'
+import { authorizeAndReply } from '../../serverAuthorization.js'
 
 export default async function (interaction) {
+  if (!await authorizeAndReply(interaction)) return
   const targetUser = interaction.options.get('user').user
   const newNickname = await getNewNickname(targetUser)
   if (newNickname === false) {
     interaction.reply({
       content: `**Error:** User <@${targetUser.id}> has not linked a Kerberos account. Their nickname cannot be reset.`,
diff --git a/discordBot/commands/User/logic/Get Profile from Linked Kerberos.js b/discordBot/commands/User/logic/Get Profile from Linked Kerberos.js
index 576d9a5..4e4f649 100644
--- a/discordBot/commands/User/logic/Get Profile from Linked Kerberos.js	
+++ b/discordBot/commands/User/logic/Get Profile from Linked Kerberos.js	
@@ -1,8 +1,10 @@
 import { profileText } from '../../common/kerbid.js'
+import { authorizeAndReply } from '../../serverAuthorization.js'
 
 export default async function (interaction) {
+  if (!await authorizeAndReply(interaction)) return
   interaction.reply({
     content: await profileText(interaction.options.get('user').user),
     allowedMentions: {
       parse: []
     },
diff --git a/discordBot/commands/serverAuthorization.js b/discordBot/commands/serverAuthorization.js
new file mode 100644
index 0000000..94ecf0a
--- /dev/null
+++ b/discordBot/commands/serverAuthorization.js
@@ -0,0 +1,17 @@
+import { configDb } from '../../lib/preferencesReader.js'
+
+export async function authorize (interaction) {
+  return Object.keys(await configDb.getDocumentByName('servers')).includes(interaction.guildId)
+}
+
+export async function authorizeAndReply (interaction, ephemeralResponse = true) {
+  if (await authorize(interaction)) {
+    return true
+  } else {
+    await interaction.reply({
+      content: '**Error!** This server is not authorized to perform the attempted action.',
+      ephemeral: ephemeralResponse
+    })
+    return false
+  }
+}

Fixed code: import { authorizeAndReply } from '../../serverAuthorization.js'
  if (!await authorizeAndReply(interaction)) return
import { authorizeAndReply } from '../../serverAuthorization.js'
  if (!await authorizeAndReply(interaction)) return
import { authorizeAndReply } from '../../serverAuthorization.js'
  if (!await authorizeAndReply(interaction)) return
import { configDb } from '../../lib/preferencesReader.js'

export async function authorize (interaction) {
  return Object.keys(await configDb.getDocumentByName('servers')).includes(interaction.guildId)
}

export async function authorizeAndReply (interaction, ephemeralResponse = true) {
  if (await authorize(interaction)) {
    return true
  } else {
    await interaction.reply({
      content: '**Error!** This server is not authorized to perform the attempted action.',
      ephemeral: ephemeralResponse
    })
    return false
  }
}