CVE-2021-29501 (published 2021-05-10T17:15Z)

Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/Dav-Git/Dav-Cogs
commit_details: repo_url: https://github.com/Dav-Git/Dav-Cogs
author: Dav
author_date: 2021-05-09 10:53:53+00:00
msg: Merge pull request from GHSA-r2cf-49r7-pfj7

* fix issue with vaiables

* upgrade version
repository: repo_url: https://github.com/Dav-Git/Dav-Cogs
repo_name: Dav-Git/Dav-Cogs
description: Dav's cogs for Red-DiscordBot
repo_language: Python
owner: Dav-Git
file_changes: filename: ticketer.py
change_type: ModificationType.MODIFY
diff: @@ -6,14 +6,15 @@ from redbot.core import commands, checks, Config, modlog
 
 class Ticketer(commands.Cog):
     """Ticketer"""
-    __version__="1.0.0"
+
+    __version__ = "1.0.1"
 
     async def red_delete_data_for_user(self, *, requester, user_id):
         # This cog stores no EUD
         return
 
     def format_help_for_context(self, ctx: commands.Context) -> str:
-        #Thanks Sinbad! And Trusty in whose cogs I found this.
+        # Thanks Sinbad! And Trusty in whose cogs I found this.
         pre_processed = super().format_help_for_context(ctx)
         return f"{pre_processed}\n\nVersion: {self.__version__}"
 
@@ -83,7 +84,7 @@ class Ticketer(commands.Cog):
     async def message(self, ctx, *, message: str):
         """Set the message that is shown at the start of each ticket channel.\n\nUse ``{user.mention}`` to mention the person who created the ticket."""
         try:
-            message.format(user=ctx.author)
+            message.format(user=SafeMember(ctx.author))
             await self.config.guild(ctx.guild).message.set(message)
             await ctx.send(f"The message has been set to `{message}`.")
         except KeyError:
@@ -244,7 +245,7 @@ class Ticketer(commands.Cog):
                     category=ctx.guild.get_channel(settings["open_category"]),
                     topic=reason,
                 )
-                await ticketchannel.send(settings["message"].format(user=ctx.author))
+                await ticketchannel.send(settings["message"].format(user=SafeMember(ctx.author)))
                 embed = discord.Embed(
                     title=name,
                     description=reason,
@@ -368,3 +369,17 @@ class Ticketer(commands.Cog):
             return True
         else:
             return False
+
+
+class SafeMember:
+    """Thank you kenny https://github.com/kennnyshiwa/kennnyshiwa-cogs"""
+
+    def __init__(self, member: discord.Member):
+        self.name = member.name
+        self.mention = member.mention
+
+    def __str__(self):
+        return self.name
+
+    def __getattr__(self, name):
+        return ""
\ No newline at end of file

programming_language: Python