CVE-2021-37697 (published 2021-08-11T23:15Z)

tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive information by crafting a specific membership event message. Issue is patched in commit d63c49b4cfc30c795336e4fff08cba3795e0fcc0. As a workaround users may unload the Welcome cog.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/tmercswims/tmerc-cogs
commit_details: repo_url: https://github.com/tmercswims/tmerc-cogs
author: Thomas Mercurio
author_date: 2021-08-10 20:28:01-07:00
msg: fix(Welcome): only allow use of safe model attributes
repository: repo_url: https://github.com/tmercswims/tmerc-cogs
repo_name: tmercswims/tmerc-cogs
description: Cogs for the Red Discord bot.
repo_language: Python
owner: tmercswims
file_changes: filename: safemodels.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,52 @@
+import discord
+
+
+class SafeMember:
+    def __init__(self, member: discord.Member) -> None:
+        self.name = str(member.name)
+        self.display_name = str(member.display_name)
+        self.nick = str(member.nick)
+        self.id = str(member.id)
+        self.mention = str(member.mention)
+        self.discriminator = str(member.discriminator)
+        self.color = str(member.color)
+        self.colour = str(member.colour)
+        self.created_at = str(member.created_at)
+        self.joined_at = str(member.joined_at)
+
+    def __str__(self):
+        return self.name
+
+    def __getattr__(self, name):
+        return self
+
+
+class SafeRole:
+    def __init__(self, role: discord.Role) -> None:
+        self.name = str(role.name)
+        self.id = str(role.id)
+        self.mention = str(role.mention)
+        self.color = str(role.color)
+        self.colour = str(role.colour)
+        self.position = str(role.position)
+        self.created_at = str(role.created_at)
+
+    def __str__(self):
+        return self.name
+
+    def __getattr__(self, name):
+        return self
+
+
+class SafeGuild:
+    def __init__(self, guild: discord.Guild) -> None:
+        self.name = str(guild.name)
+        self.id = str(guild.id)
+        self.description = str(guild.description)
+        self.created_at = str(guild.created_at)
+
+    def __str__(self):
+        return self.name
+
+    def __getattr__(self, name):
+        return self

programming_language: Python
filename: welcome.py
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,7 @@ from redbot.core.utils.chat_formatting import box, humanize_list, pagify
 
 from .enums import WhisperType
 from .errors import WhisperError
+from .safemodels import SafeGuild, SafeMember
 
 __author__ = "tmerc"
 
@@ -791,7 +792,14 @@ class Welcome(commands.Cog):
 
         try:
             return await channel.send(
-                format_str.format(member=user, server=guild, bot=user, count=count or "", plural=plural, roles=role_str)
+                format_str.format(
+                    member=SafeMember(user),
+                    server=SafeGuild(guild),
+                    bot=SafeMember(user),
+                    count=count or "",
+                    plural=plural,
+                    roles=role_str,
+                )
             )
         except discord.Forbidden:
             log.error(

programming_language: Python