CVE-2024-31442 (Python, published 2024-04-08T16:15Z)
Description: value: Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Redon-Tech/Redon-Hub
Files changed:
bot/__init__.py
bot/cogs/product.py
bot/cogs/tag.py
bot/cogs/user.py
Commit message: V1.0.2


Vulnerable code:
from discord import Object as DiscordObject
__version__ = "1.0.0"
    Member,
    get_product,
        default_permissions=None,
            await interaction.response.send_message(
                embed=Embed(
                    title="Error",
                    description="You are not allowed to use this command.",
                    colour=interaction.user.colour,
                    timestamp=utils.utcnow(),
                ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
            )
            return
    TextStyle,
    ButtonStyle,
        default_permissions=None,
from discord import app_commands, Interaction, Member, Embed, utils, Forbidden
        default_permissions=None,

Fixed code:
from discord import Interaction, Embed
from discord.app_commands import AppCommandError, MissingPermissions
import datetime
__version__ = "1.0.2"
        self.tree.on_error = self.on_app_command_error


    async def on_app_command_error(
        self, interaction: Interaction, error: AppCommandError
    ):
        if isinstance(error, MissingPermissions):
            await interaction.response.send_message(
                embed=Embed(
                    title="Error",
                    description="You are not allowed to use this command.",
                    colour=interaction.user.colour,
                    timestamp=datetime.datetime.now(datetime.timezone.utc),
                ).set_footer(text=f"Redon Hub • Version {self.version}"),
            )

        _log.error(error)

from discord.app_commands import MissingPermissions
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
            # await interaction.response.send_message(
            #     embed=Embed(
            #         title="Error",
            #         description="You are not allowed to use this command.",
            #         colour=interaction.user.colour,
            #         timestamp=utils.utcnow(),
            #     ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
            # )
            # return
            raise MissingPermissions("Bot Owner")
    @app_commands.checks.has_permissions(administrator=True)

    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)

from discord import (
    app_commands,
    Interaction,
    Member,
    Embed,
    utils,
    Forbidden,
)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)
    @app_commands.checks.has_permissions(administrator=True)