CVE-2024-35237 (published 2024-05-27T17:15Z)

MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals\' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a "public" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To prevent exploitation of the vulnerability, all vulnerable instances of IdentiBot should be taken offline until they have been updated.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ZelnickB/mit-identibot
commit_details: repo_url: https://github.com/ZelnickB/mit-identibot
author: Benjamin Zelnick
author_date: 2024-05-27 01:30:30-04:00
msg: Patched GHSA-h8r9-7r8x-78v6

This commit patches GHSA-h8r9-7r8x-78v6 by performing an authorization check (i.e., checking whether the server is registered) before the use of `/kerbid` and `/resetnick` (as well as the corresponding user commands).
repository: repo_url: https://github.com/ZelnickB/mit-identibot
repo_name: ZelnickB/mit-identibot
description: Bot/web service to link MIT Kerberos accounts with Discord accounts.
repo_language: JavaScript
owner: ZelnickB
file_changes: filename: kerbid.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,8 @@
 import { profileText } from '../../common/kerbid.js'
+import { authorizeAndReply } from '../../serverAuthorization.js'
 
 export default async function (interaction) {
+  if (!await authorizeAndReply(interaction)) return
   interaction.reply({
     content: await profileText(interaction.options.get('user').user),
     allowedMentions: {

programming_language: JavaScript
filename: resetnick.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,8 @@
 import { getNewNickname } from '../../common/resetnick.js'
+import { authorizeAndReply } from '../../serverAuthorization.js'
 
 export default async function (interaction) {
+  if (!await authorizeAndReply(interaction)) return
   const targetUser = interaction.options.get('user').user
   const newNickname = await getNewNickname(targetUser)
   if (newNickname === false) {

programming_language: JavaScript
filename: Get Profile from Linked Kerberos.js
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,8 @@
 import { profileText } from '../../common/kerbid.js'
+import { authorizeAndReply } from '../../serverAuthorization.js'
 
 export default async function (interaction) {
+  if (!await authorizeAndReply(interaction)) return
   interaction.reply({
     content: await profileText(interaction.options.get('user').user),
     allowedMentions: {

programming_language: JavaScript
filename: serverAuthorization.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,17 @@
+import { configDb } from '../../lib/preferencesReader.js'
+
+export async function authorize (interaction) {
+  return Object.keys(await configDb.getDocumentByName('servers')).includes(interaction.guildId)
+}
+
+export async function authorizeAndReply (interaction, ephemeralResponse = true) {
+  if (await authorize(interaction)) {
+    return true
+  } else {
+    await interaction.reply({
+      content: '**Error!** This server is not authorized to perform the attempted action.',
+      ephemeral: ephemeralResponse
+    })
+    return false
+  }
+}

programming_language: JavaScript