CVE-2022-39302 (Java, published 2022-10-14T00:15Z)
Description: value: Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements. This issue has been patched in version 1.9.9. There are currently no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/Ree6-Applications/Ree6
Files changed:
src/main/java/de/presti/ree6/commands/impl/community/InstagramNotifier.java
src/main/java/de/presti/ree6/commands/impl/community/RedditNotifier.java
src/main/java/de/presti/ree6/commands/impl/community/TwitchNotifier.java
src/main/java/de/presti/ree6/commands/impl/community/TwitterNotifier.java
src/main/java/de/presti/ree6/commands/impl/community/YouTubeNotifier.java
src/main/java/de/presti/ree6/commands/impl/mod/EmbedSender.java
src/main/java/de/presti/ree6/commands/impl/mod/Import.java
src/main/java/de/presti/ree6/commands/impl/mod/Setup.java
src/main/java/de/presti/ree6/events/OtherEvents.java
src/main/java/de/presti/ree6/sql/SQLWorker.java
Commit message: Removed News-Channel.
Fixed Cross-Server Channel Exploit.
Fixed Temporal-Voice setup.


Vulnerable code:
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
            optionList.add(SelectOption.of("News-channel", "news"));
                    case "news" -> {
                        optionList.add(SelectOption.of("Setup", "newsSetup"));

                        if (Main.getInstance().getSqlConnector().getSqlWorker().isNewsSetup(event.getGuild().getId()))
                            optionList.add(SelectOption.of("Delete", "newsDelete"));

                        optionList.add(SelectOption.of("Back to Menu", "backToSetupMenu"));

                        embedBuilder.setDescription("You can set up our own Ree6-News!\nBy setting up Ree6-News on a specific channel you will get a Message in the given Channel, when ever Ree6 gets an update!");

                        event.editMessageEmbeds(embedBuilder.build()).setActionRow(new SelectMenuImpl("setupNewsMenu", "Select your Action", 1, 1, false, optionList)).queue();
                    }

                        if (Main.getInstance().getSqlConnector().getSqlWorker().isNewsSetup(event.getGuild().getId()))
            case "setupNewsMenu" -> {

                if (checkPerms(event.getMember(), event.getChannel())) {
                    return;
                }

                EmbedBuilder embedBuilder = new EmbedBuilder(event.getMessage().getEmbeds().get(0));

                List<SelectOption> optionList = new ArrayList<>();

                switch (event.getInteraction().getValues().get(0)) {

                    case "backToSetupMenu" -> sendDefaultChoice(event);

                    case "newsSetup" -> {
                        for (TextChannel channel : event.getGuild().getTextChannels()) {
                            optionList.add(SelectOption.of(channel.getName(), channel.getId()));
                        }

                        embedBuilder.setDescription("Which Channel do you want to use as News-Channel?");

                        event.editMessageEmbeds(embedBuilder.build()).setActionRow(new SelectMenuImpl("setupNewsChannel", "Select a Channel!", 1, 1, false, optionList)).queue();
                    }

                    default -> {
                        if (event.getMessage().getEmbeds().isEmpty() || event.getMessage().getEmbeds().get(0) == null)
                            return;

                        embedBuilder.setDescription("You somehow selected a Invalid Option? Are you a Wizard?");
                        event.editMessageEmbeds(embedBuilder.build()).queue();
                    }
                }
            }

            case "setupNewsChannel" -> {
                if (checkPerms(event.getMember(), event.getChannel())) {
                    return;
                }

                EmbedBuilder embedBuilder = new EmbedBuilder(event.getMessage().getEmbeds().get(0));

                TextChannel textChannel = event.getGuild().getTextChannelById(event.getInteraction().getValues().get(0));

                if (textChannel != null) {
                    textChannel.createWebhook("Ree6-News").queue(webhook -> {
                        Main.getInstance().getSqlConnector().getSqlWorker().setNewsWebhook(event.getGuild().getId(), webhook.getId(), webhook.getToken());
                        embedBuilder.setDescription("Successfully changed the News-Channel, nice work!");
                        embedBuilder.setColor(Color.GREEN);
                        event.editMessageEmbeds(embedBuilder.build()).setComponents(new ArrayList<>()).queue();
                    });
                } else {
                    embedBuilder.setDescription("The given Channel doesn't exists, how did you select it? Are you a Wizard?");
                    event.editMessageEmbeds(embedBuilder.build()).queue();
                }
            }

        optionList.add(SelectOption.of("News-channel", "news"));
    //region News

    /**
     * Get the NewsWebhooks data.
     *
     * @param guildId the ID of the Guild.
     * @return {@link WebhookNews} with all the needed data.
     */
    public WebhookNews getNewsWebhook(String guildId) {
        SQLResponse sqlResponse = getEntity(WebhookNews.class, "SELECT * FROM NewsWebhooks WHERE GID=?", guildId);
        return sqlResponse.isSuccess() ? (WebhookNews) sqlResponse.getEntity() : null;
    }

    /**
     * Set the NewsWebhooks in our Database.
     *
     * @param guildId   the ID of the Guild.
     * @param webhookId the ID of the Webhook.
     * @param authToken the Auth-token to verify the access.
     */
    public void setNewsWebhook(String guildId, String webhookId, String authToken) {

        // Check if there is already a Webhook set.
        if (isNewsSetup(guildId)) {
            // Get the Guild from the ID.
            Guild guild = BotWorker.getShardManager().getGuildById(guildId);

            if (guild != null) {
                Webhook webhookEntity = getNewsWebhook(guildId);
                // Delete the existing Webhook.
                guild.retrieveWebhooks().queue(webhooks -> webhooks.stream().filter(webhook -> webhook.getToken() != null).filter(webhook -> webhook.getId().equalsIgnoreCase(webhookEntity.getChannelId()) && webhook.getToken().equalsIgnoreCase(webhookEntity.getToken())).forEach(webhook -> webhook.delete().queue()));
            }

            // Delete the entry.
            sqlConnector.querySQL("DELETE FROM NewsWebhooks WHERE GID=?", guildId);
        }

        saveEntity(new WebhookNews(guildId, webhookId, authToken));

    }

    /**
     * Check if the News Webhook has been set in our Database for this Server.
     *
     * @param guildId the ID of the Guild.
     * @return {@link Boolean} if true, it has been set | if false, it hasn't been set.
     */
    public boolean isNewsSetup(String guildId) {
        return getEntity(WebhookNews.class, "SELECT * FROM NewsWebhooks WHERE GID=?", guildId).isSuccess();
    }

    //endregion

package de.presti.ree6.sql.entities.webhook;

import de.presti.ree6.sql.base.annotations.Table;

/**
 * SQL Entity for the News-Webhooks.
 */
@Table(name = "NewsWebhooks")
public class WebhookNews extends Webhook {

    /**
     * Constructor.
     */
    public WebhookNews() {
    }

    /**
     * @inheritDoc
     */
    public WebhookNews(String guildId, String channelId, String token) {
        super(guildId, channelId, token);
    }
}

Fixed code:
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
import net.dv8tion.jda.api.Permission;
        if (!commandEvent.getMember().hasPermission(Permission.MESSAGE_MANAGE)) {
            commandEvent.reply("You do not have the permission to do that!");
            return;
        }

import net.dv8tion.jda.api.Permission;
        if (!commandEvent.getMember().hasPermission(Permission.MANAGE_SERVER)) {
            commandEvent.reply("You do not have the permission to do that!");
            return;
        }

                        if (Main.getInstance().getSqlConnector().getSqlWorker().getEntity(TemporalVoicechannel.class, "SELECT * FROM TemporalVoicechannel WHERE GID=?", event.getGuild().getId()).isSuccess())