CVE-2022-39302 (published 2022-10-14T00:15Z)

Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements. This issue has been patched in version 1.9.9. There are currently no known workarounds.

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/Ree6-Applications/Ree6
commit_details: repo_url: https://github.com/Ree6-Applications/Ree6
author: Presti
author_date: 2022-09-30 12:54:07+02:00
msg: Removed News-Channel.
Fixed Cross-Server Channel Exploit.
Fixed Temporal-Voice setup.
repository: repo_url: https://github.com/Ree6-Applications/Ree6
repo_name: Ree6-Applications/Ree6
description: All-in-one, open source and 100% free Discord Bot!
repo_language: Java
owner: Ree6-Applications
file_changes: filename: InstagramNotifier.java
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,8 @@ public class InstagramNotifier implements ICommand {
             }
         } else if(commandEvent.getArguments().length == 3) {
 
-            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
+            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
+                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
                 Main.getInstance().getCommandManager().sendMessage("Please use " + Main.getInstance().getSqlConnector().getSqlWorker().getSetting(commandEvent.getGuild().getId(), "chatprefix").getStringValue() + "instagramnotifier add/remove InstagramName #Channel", 5, commandEvent.getChannel(), commandEvent.getInteractionHook());
                 return;
             }

programming_language: Java
filename: RedditNotifier.java
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,8 @@ public class RedditNotifier implements ICommand {
             }
         } else if(commandEvent.getArguments().length == 3) {
 
-            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
+            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
+                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
                 Main.getInstance().getCommandManager().sendMessage("Please use " + Main.getInstance().getSqlConnector().getSqlWorker().getSetting(commandEvent.getGuild().getId(), "chatprefix").getStringValue() + "redditnotifier add/remove Subreddit #Channel", 5, commandEvent.getChannel(), commandEvent.getInteractionHook());
                 return;
             }

programming_language: Java
filename: TwitchNotifier.java
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,8 @@ public class TwitchNotifier implements ICommand {
             }
         } else if (commandEvent.getArguments().length == 3) {
 
-            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
+            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
+                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
                 Main.getInstance().getCommandManager().sendMessage("Please use " + Main.getInstance().getSqlConnector().getSqlWorker().getSetting(commandEvent.getGuild().getId(), "chatprefix").getStringValue() + "twitch add/remove TwitchName #Channel", 5, commandEvent.getChannel(), commandEvent.getInteractionHook());
                 return;
             }

programming_language: Java
filename: TwitterNotifier.java
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,8 @@ public class TwitterNotifier implements ICommand {
             }
         } else if(commandEvent.getArguments().length == 3) {
 
-            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
+            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
+                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
                 Main.getInstance().getCommandManager().sendMessage("Please use " + Main.getInstance().getSqlConnector().getSqlWorker().getSetting(commandEvent.getGuild().getId(), "chatprefix").getStringValue() + "twitternotifier add/remove TwitterName #Channel", 5, commandEvent.getChannel(), commandEvent.getInteractionHook());
                 return;
             }

programming_language: Java
filename: YouTubeNotifier.java
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,8 @@ public class YouTubeNotifier implements ICommand {
             }
         } else if(commandEvent.getArguments().length == 3) {
 
-            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty()) {
+            if (commandEvent.getMessage().getMentions().getChannels(TextChannel.class).isEmpty() ||
+                    !commandEvent.getMessage().getMentions().getChannels(TextChannel.class).get(0).getGuild().getId().equals(commandEvent.getGuild().getId())) {
                 Main.getInstance().getCommandManager().sendMessage("Please use " + Main.getInstance().getSqlConnector().getSqlWorker().getSetting(commandEvent.getGuild().getId(), "chatprefix").getStringValue() + "youtubenotifier add/remove YouTubeChannel #Channel", 5, commandEvent.getChannel(), commandEvent.getInteractionHook());
                 return;
             }

programming_language: Java
filename: EmbedSender.java
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@ import de.presti.ree6.commands.interfaces.Command;
 import de.presti.ree6.commands.interfaces.ICommand;
 import de.presti.ree6.main.Main;
 import net.dv8tion.jda.api.EmbedBuilder;
+import net.dv8tion.jda.api.Permission;
 import net.dv8tion.jda.api.interactions.commands.OptionMapping;
 import net.dv8tion.jda.api.interactions.commands.OptionType;
 import net.dv8tion.jda.api.interactions.commands.build.CommandData;
@@ -30,6 +31,11 @@ public class EmbedSender implements ICommand {
             return;
         }
 
+        if (!commandEvent.getMember().hasPermission(Permission.MESSAGE_MANAGE)) {
+            commandEvent.reply("You do not have the permission to do that!");
+            return;
+        }
+
         OptionMapping title = commandEvent.getSlashCommandInteractionEvent().getOption("title");
         OptionMapping description = commandEvent.getSlashCommandInteractionEvent().getOption("description");
         OptionMapping color = commandEvent.getSlashCommandInteractionEvent().getOption("color");

programming_language: Java
filename: Import.java
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,7 @@ import de.presti.ree6.commands.interfaces.ICommand;
 import de.presti.ree6.main.Main;
 import de.presti.ree6.sql.entities.level.ChatUserLevel;
 import de.presti.ree6.utils.external.RequestUtility;
+import net.dv8tion.jda.api.Permission;
 import net.dv8tion.jda.api.interactions.commands.OptionMapping;
 import net.dv8tion.jda.api.interactions.commands.OptionType;
 import net.dv8tion.jda.api.interactions.commands.build.CommandData;
@@ -24,6 +25,11 @@ public class Import implements ICommand {
      */
     @Override
     public void onPerform(CommandEvent commandEvent) {
+        if (!commandEvent.getMember().hasPermission(Permission.MANAGE_SERVER)) {
+            commandEvent.reply("You do not have the permission to do that!");
+            return;
+        }
+
         if (commandEvent.isSlashCommand()) {
             OptionMapping optionMapping = commandEvent.getSlashCommandInteractionEvent().getOption("bot");
             commandEvent.getArguments()[0] = optionMapping.getAsString();

programming_language: Java
filename: Setup.java
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,6 @@ public class Setup implements ICommand {
             List<SelectOption> optionList = new ArrayList<>();
             optionList.add(SelectOption.of("Audit-Logging", "log"));
             optionList.add(SelectOption.of("Welcome-channel", "welcome"));
-            optionList.add(SelectOption.of("News-channel", "news"));
             optionList.add(SelectOption.of("Autorole", "autorole"));
             optionList.add(SelectOption.of("Temporal-Voice", "tempvoice"));
             optionList.add(SelectOption.of("Statistics", "statistics"));

programming_language: Java
filename: OtherEvents.java
change_type: ModificationType.MODIFY
diff: @@ -864,19 +864,6 @@ public class OtherEvents extends ListenerAdapter {
                         event.editMessageEmbeds(embedBuilder.build()).setActionRow(new SelectMenuImpl("setupWelcomeMenu", "Select your Action", 1, 1, false, optionList)).queue();
                     }
 
-                    case "news" -> {
-                        optionList.add(SelectOption.of("Setup", "newsSetup"));
-
-                        if (Main.getInstance().getSqlConnector().getSqlWorker().isNewsSetup(event.getGuild().getId()))
-                            optionList.add(SelectOption.of("Delete", "newsDelete"));
-
-                        optionList.add(SelectOption.of("Back to Menu", "backToSetupMenu"));
-
-                        embedBuilder.setDescription("You can set up our own Ree6-News!\nBy setting up Ree6-News on a specific channel you will get a Message in the given Channel, when ever Ree6 gets an update!");
-
-                        event.editMessageEmbeds(embedBuilder.build()).setActionRow(new SelectMenuImpl("setupNewsMenu", "Select your Action", 1, 1, false, optionList)).queue();
-                    }
-
                     case "autorole" -> {
                         embedBuilder.setDescription("You can set up our own Autorole-System!\nYou can select Roles that Users should get upon joining the Server!");
 
@@ -886,7 +873,7 @@ public class OtherEvents extends ListenerAdapter {
                     case "tempvoice" -> {
                         optionList.add(SelectOption.of("Setup", "tempVoiceSetup"));
 
-                        if (Main.getInstance().getSqlConnector().getSqlWorker().isNewsSetup(event.getGuild().getId()))
+                        if (Main.getInstance().getSqlConnector().getSqlWorker().getEntity(TemporalVoicechannel.class, "SELECT * FROM TemporalVoicechannel WHERE GID=?", event.getGuild().getId()).isSuccess())
                             optionList.add(SelectOption.of("Delete", "tempVoiceDelete"));
 
                         optionList.add(SelectOption.of("Back to Menu", "backToSetupMenu"));
@@ -1220,62 +1207,6 @@ public class OtherEvents extends ListenerAdapter {
 
             }
 
-            case "setupNewsMenu" -> {
-
-                if (checkPerms(event.getMember(), event.getChannel())) {
-                    return;
-                }
-
-                EmbedBuilder embedBuilder = new EmbedBuilder(event.getMessage().getEmbeds().get(0));
-
-                List<SelectOption> optionList = new ArrayList<>();
-
-                switch (event.getInteraction().getValues().get(0)) {
-
-                    case "backToSetupMenu" -> sendDefaultChoice(event);
-
-                    case "newsSetup" -> {
-                        for (TextChannel channel : event.getGuild().getTextChannels()) {
-                            optionList.add(SelectOption.of(channel.getName(), channel.getId()));
-                        }
-
-                        embedBuilder.setDescription("Which Channel do you want to use as News-Channel?");
-
-                        event.editMessageEmbeds(embedBuilder.build()).setActionRow(new SelectMenuImpl("setupNewsChannel", "Select a Channel!", 1, 1, false, optionList)).queue();
-                    }
-
-                    default -> {
-                        if (event.getMessage().getEmbeds().isEmpty() || event.getMessage().getEmbeds().get(0) == null)
-                            return;
-
-                        embedBuilder.setDescription("You somehow selected a Invalid Option? Are you a Wizard?");
-                        event.editMessageEmbeds(embedBuilder.build()).queue();
-                    }
-                }
-            }
-
-            case "setupNewsChannel" -> {
-                if (checkPerms(event.getMember(), event.getChannel())) {
-                    return;
-                }
-
-                EmbedBuilder embedBuilder = new EmbedBuilder(event.getMessage().getEmbeds().get(0));
-
-                TextChannel textChannel = event.getGuild().getTextChannelById(event.getInteraction().getValues().get(0));
-
-                if (textChannel != null) {
-                    textChannel.createWebhook("Ree6-News").queue(webhook -> {
-                        Main.getInstance().getSqlConnector().getSqlWorker().setNewsWebhook(event.getGuild().getId(), webhook.getId(), webhook.getToken());
-                        embedBuilder.setDescription("Successfully changed the News-Channel, nice work!");
-                        embedBuilder.setColor(Color.GREEN);
-                        event.editMessageEmbeds(embedBuilder.build()).setComponents(new ArrayList<>()).queue();
-                    });
-                } else {
-                    embedBuilder.setDescription("The given Channel doesn't exists, how did you select it? Are you a Wizard?");
-                    event.editMessageEmbeds(embedBuilder.build()).queue();
-                }
-            }
-
             default -> {
                 if (event.getMessage().getEmbeds().isEmpty() || event.getMessage().getEmbeds().get(0) == null) return;
 
@@ -1298,7 +1229,6 @@ public class OtherEvents extends ListenerAdapter {
         List<SelectOption> optionList = new ArrayList<>();
         optionList.add(SelectOption.of("Audit-Logging", "log"));
         optionList.add(SelectOption.of("Welcome-channel", "welcome"));
-        optionList.add(SelectOption.of("News-channel", "news"));
         optionList.add(SelectOption.of("Autorole", "autorole"));
         optionList.add(SelectOption.of("Temporal-Voice", "tempvoice"));
         optionList.add(SelectOption.of("Statistics", "statistics"));

programming_language: Java
filename: SQLWorker.java
change_type: ModificationType.MODIFY
diff: @@ -352,59 +352,6 @@ public record SQLWorker(SQLConnector sqlConnector) {
 
     //endregion
 
-    //region News
-
-    /**
-     * Get the NewsWebhooks data.
-     *
-     * @param guildId the ID of the Guild.
-     * @return {@link WebhookNews} with all the needed data.
-     */
-    public WebhookNews getNewsWebhook(String guildId) {
-        SQLResponse sqlResponse = getEntity(WebhookNews.class, "SELECT * FROM NewsWebhooks WHERE GID=?", guildId);
-        return sqlResponse.isSuccess() ? (WebhookNews) sqlResponse.getEntity() : null;
-    }
-
-    /**
-     * Set the NewsWebhooks in our Database.
-     *
-     * @param guildId   the ID of the Guild.
-     * @param webhookId the ID of the Webhook.
-     * @param authToken the Auth-token to verify the access.
-     */
-    public void setNewsWebhook(String guildId, String webhookId, String authToken) {
-
-        // Check if there is already a Webhook set.
-        if (isNewsSetup(guildId)) {
-            // Get the Guild from the ID.
-            Guild guild = BotWorker.getShardManager().getGuildById(guildId);
-
-            if (guild != null) {
-                Webhook webhookEntity = getNewsWebhook(guildId);
-                // Delete the existing Webhook.
-                guild.retrieveWebhooks().queue(webhooks -> webhooks.stream().filter(webhook -> webhook.getToken() != null).filter(webhook -> webhook.getId().equalsIgnoreCase(webhookEntity.getChannelId()) && webhook.getToken().equalsIgnoreCase(webhookEntity.getToken())).forEach(webhook -> webhook.delete().queue()));
-            }
-
-            // Delete the entry.
-            sqlConnector.querySQL("DELETE FROM NewsWebhooks WHERE GID=?", guildId);
-        }
-
-        saveEntity(new WebhookNews(guildId, webhookId, authToken));
-
-    }
-
-    /**
-     * Check if the News Webhook has been set in our Database for this Server.
-     *
-     * @param guildId the ID of the Guild.
-     * @return {@link Boolean} if true, it has been set | if false, it hasn't been set.
-     */
-    public boolean isNewsSetup(String guildId) {
-        return getEntity(WebhookNews.class, "SELECT * FROM NewsWebhooks WHERE GID=?", guildId).isSuccess();
-    }
-
-    //endregion
-
     //region Twitch Notifier
 
     /**

programming_language: Java
filename: WebhookNews.java
change_type: ModificationType.DELETE
diff: @@ -1,23 +0,0 @@
-package de.presti.ree6.sql.entities.webhook;
-
-import de.presti.ree6.sql.base.annotations.Table;
-
-/**
- * SQL Entity for the News-Webhooks.
- */
-@Table(name = "NewsWebhooks")
-public class WebhookNews extends Webhook {
-
-    /**
-     * Constructor.
-     */
-    public WebhookNews() {
-    }
-
-    /**
-     * @inheritDoc
-     */
-    public WebhookNews(String guildId, String channelId, String token) {
-        super(guildId, channelId, token);
-    }
-}

programming_language: unknown