CVE-2024-39905 (published 2024-07-11T16:15Z)

Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Cog-Creators/Red-DiscordBot
commit_details: repo_url: https://github.com/Cog-Creators/Red-DiscordBot
author: Michael Oliveira
author_date: 2024-07-10 14:41:24-04:00
msg: Fix `@commands.can_manage_channel` always passing (#6398)
repository: repo_url: https://github.com/Cog-Creators/Red-DiscordBot
repo_name: Cog-Creators/Red-DiscordBot
description: A multi-function Discord bot
repo_language: Python
owner: Cog-Creators
file_changes: filename: requires.py
change_type: ModificationType.MODIFY
diff: @@ -761,7 +761,7 @@ def bot_can_react() -> Callable[[_T], _T]:
 
 
 def _can_manage_channel_deco(
-    privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
+    *, privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
 ) -> Callable[[_T], _T]:
     async def predicate(ctx: "Context") -> bool:
         if utils.can_user_manage_channel(
@@ -803,7 +803,7 @@ def can_manage_channel(*, allow_thread_owner: bool = False) -> Callable[[_T], _T
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(allow_thread_owner)
+    return _can_manage_channel_deco(allow_thread_owner=allow_thread_owner)
 
 
 def is_owner():
@@ -837,7 +837,9 @@ def guildowner_or_can_manage_channel(*, allow_thread_owner: bool = False) -> Cal
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(PrivilegeLevel.GUILD_OWNER, allow_thread_owner)
+    return _can_manage_channel_deco(
+        privilege_level=PrivilegeLevel.GUILD_OWNER, allow_thread_owner=allow_thread_owner
+    )
 
 
 def guildowner():
@@ -871,7 +873,9 @@ def admin_or_can_manage_channel(*, allow_thread_owner: bool = False) -> Callable
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(PrivilegeLevel.ADMIN, allow_thread_owner)
+    return _can_manage_channel_deco(
+        privilege_level=PrivilegeLevel.ADMIN, allow_thread_owner=allow_thread_owner
+    )
 
 
 def admin():
@@ -905,7 +909,9 @@ def mod_or_can_manage_channel(*, allow_thread_owner: bool = False) -> Callable[[
         as that, in addition to members with manage channel/threads permission,
         can also be done by the thread owner.
     """
-    return _can_manage_channel_deco(PrivilegeLevel.MOD, allow_thread_owner)
+    return _can_manage_channel_deco(
+        privilege_level=PrivilegeLevel.MOD, allow_thread_owner=allow_thread_owner
+    )
 
 
 def mod():

programming_language: Python