CVE-2024-31442 (published 2024-04-08T16:15Z)

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Redon-Tech/Redon-Hub
commit_details: repo_url: https://github.com/Redon-Tech/Redon-Hub
author: parker02311
author_date: 2024-04-06 22:34:43-10:00
msg: V1.0.2
repository: repo_url: https://github.com/Redon-Tech/Redon-Hub
repo_name: Redon-Tech/Redon-Hub
description: Redon Hub is a Roblox Product Delivery Bot (AKA Hub), it is designed to be as useful as other hub systems such as myPod, Parcel, and more while being 100% free and open source.
repo_language: Python
owner: Redon-Tech
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -3,16 +3,18 @@
     Usage: The bot's main file.
 """
 
-from discord import Object as DiscordObject
+from discord import Interaction, Embed
 from discord.ext.commands import Bot as BotBase
+from discord.app_commands import AppCommandError, MissingPermissions
 from . import config
 from .data import database
 from glob import glob
 import logging
 import os
+import datetime
 
 _log = logging.getLogger(__name__)
-__version__ = "1.0.0"
+__version__ = "1.0.2"
 
 
 class Bot(BotBase):
@@ -21,6 +23,8 @@ class Bot(BotBase):
         self.ready = False
         super().__init__(*args, **kwargs)
 
+        self.tree.on_error = self.on_app_command_error
+
     async def load_extensions(self):
         # Original code from pycord
 
@@ -54,3 +58,18 @@ class Bot(BotBase):
             await database.connect()
 
             _log.info("Database Connected")
+
+    async def on_app_command_error(
+        self, interaction: Interaction, error: AppCommandError
+    ):
+        if isinstance(error, MissingPermissions):
+            await interaction.response.send_message(
+                embed=Embed(
+                    title="Error",
+                    description="You are not allowed to use this command.",
+                    colour=interaction.user.colour,
+                    timestamp=datetime.datetime.now(datetime.timezone.utc),
+                ).set_footer(text=f"Redon Hub • Version {self.version}"),
+            )
+
+        _log.error(error)

programming_language: Python
filename: product.py
change_type: ModificationType.MODIFY
diff: @@ -2,10 +2,10 @@
     File: /bot/cogs/product.py
     Usage: Product related commands
 """
+
 from discord import (
     app_commands,
     Interaction,
-    Member,
     Embed,
     utils,
     ui,
@@ -14,13 +14,13 @@ from discord import (
     ButtonStyle,
     Role,
 )
+from discord.app_commands import MissingPermissions
 from asyncio import TimeoutError
 from discord.ext.commands import Cog
 from bot.data import (
     get_users,
     get_products,
     get_product_by_name,
-    get_product,
     create_product,
     delete_product,
     get_tags,
@@ -817,7 +817,6 @@ class ProductCog(Cog):
         name="admin",
         description="Product Admin Commands",
         parent=product_commands,
-        default_permissions=None,
     )
 
     @app_commands.command(
@@ -893,6 +892,7 @@ class ProductCog(Cog):
     @product_admin.command(
         name="stats", description="Get statistics on a specific product"
     )
+    @app_commands.checks.has_permissions(administrator=True)
     async def get_product_stats_info_command(
         self, interaction: Interaction, product_name: str
     ):
@@ -939,10 +939,12 @@ class ProductCog(Cog):
         ]
 
     @product_admin.command(name="create", description="Create a new product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def create_product_command(self, interaction: Interaction):
         await interaction.response.send_modal(createProduct(bot=self.bot))
 
     @product_admin.command(name="delete", description="Delete a product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def delete_product_command(self, interaction: Interaction, product_name: str):
         try:
             product = await get_product_by_name(product_name)
@@ -1033,17 +1035,19 @@ class ProductCog(Cog):
         ]
 
     @product_admin.command(name="clear", description="Delete all products")
+    @app_commands.checks.has_permissions(administrator=True)
     async def clear_products_command(self, interaction: Interaction):
         if interaction.user.id not in config.Bot.Owners:
-            await interaction.response.send_message(
-                embed=Embed(
-                    title="Error",
-                    description="You are not allowed to use this command.",
-                    colour=interaction.user.colour,
-                    timestamp=utils.utcnow(),
-                ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
-            )
-            return
+            # await interaction.response.send_message(
+            #     embed=Embed(
+            #         title="Error",
+            #         description="You are not allowed to use this command.",
+            #         colour=interaction.user.colour,
+            #         timestamp=utils.utcnow(),
+            #     ).set_footer(text=f"Redon Hub • Version {self.bot.version}"),
+            # )
+            # return
+            raise MissingPermissions("Bot Owner")
 
         try:
             products = await get_products()
@@ -1114,6 +1118,7 @@ class ProductCog(Cog):
             )
 
     @product_admin.command(name="update", description="Update a product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def update_product_command(self, interaction: Interaction, product_name: str):
         await interaction.response.defer()
 

programming_language: Python
filename: tag.py
change_type: ModificationType.MODIFY
diff: @@ -2,15 +2,14 @@
     File: /bot/cogs/tags.py
     Usage: Tag related commands
 """
+
 from discord import (
     app_commands,
     Interaction,
     Embed,
     utils,
     ui,
-    TextStyle,
     SelectOption,
-    ButtonStyle,
 )
 from discord.ext.commands import Cog
 from bot.data import get_tag, get_tag_by_name, get_tags, create_tag, delete_tag, Tag
@@ -192,7 +191,6 @@ class TagCog(Cog):
         name="admin",
         description="Tag Admin Commands",
         parent=tag_commands,
-        default_permissions=None,
     )
 
     @app_commands.command(name="tags", description="View all the tags this server has")
@@ -260,10 +258,12 @@ class TagCog(Cog):
         ]
 
     @tag_admin.command(name="create", description="Create a new tag")
+    @app_commands.checks.has_permissions(administrator=True)
     async def create_tag_command(self, interaction: Interaction):
         await interaction.response.send_modal(createTag(bot=self.bot))
 
     @tag_admin.command(name="delete", description="Delete a tag")
+    @app_commands.checks.has_permissions(administrator=True)
     async def delete_tag_command(self, interaction: Interaction):
         await interaction.response.defer()
 
@@ -280,6 +280,7 @@ class TagCog(Cog):
         )
 
     @tag_admin.command(name="update", description="Update a tag")
+    @app_commands.checks.has_permissions(administrator=True)
     async def update_tag_command(self, interaction: Interaction, tag_name: str):
         try:
             tag = await get_tag_by_name(tag_name)

programming_language: Python
filename: user.py
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,15 @@
     File: /bot/cogs/user.py
     Usage: User related commands
 """
-from discord import app_commands, Interaction, Member, Embed, utils, Forbidden
+
+from discord import (
+    app_commands,
+    Interaction,
+    Member,
+    Embed,
+    utils,
+    Forbidden,
+)
 from discord.ext.commands import Cog
 from bot.data import (
     get_user_by_discord_id,
@@ -27,7 +35,6 @@ class User(Cog):
         name="admin",
         description="User Admin Commands",
         parent=user_commands,
-        default_permissions=None,
     )
 
     @app_commands.command(name="profile", description="View a user's profile")
@@ -391,6 +398,7 @@ class User(Cog):
         ]
 
     @user_admin.command(name="give", description="Give a user a product")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_give(
         self, interaction: Interaction, product_name: str, member: Member
     ):
@@ -483,6 +491,7 @@ class User(Cog):
             )
 
     @user_admin_give.autocomplete("product_name")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_give_autocomplete(
         self, interaction: Interaction, current_product_name: str
     ):
@@ -498,6 +507,7 @@ class User(Cog):
         ]
 
     @user_admin.command(name="revoke", description="Revoke a product from a user")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_revoke(
         self, interaction: Interaction, product_name: str, member: Member
     ):
@@ -572,6 +582,7 @@ class User(Cog):
             )
 
     @user_admin_revoke.autocomplete("product_name")
+    @app_commands.checks.has_permissions(administrator=True)
     async def user_admin_revoke_autocomplete(
         self, interaction: Interaction, current_product_name: str
     ):

programming_language: Python