CVE-2021-26918
📋 TL;DR
This vulnerability in ProBot for Discord allows attackers to upload malicious files with double extensions (like .html.jpg) that are served with text/html content type. This could enable cross-site scripting (XSS) attacks or other client-side attacks when users view uploaded content. The vulnerability affects Discord servers using ProBot with the 'Send an image when a user joins' feature enabled.
💻 Affected Systems
- ProBot for Discord
📦 What is this software?
Bot by Probot
⚠️ Risk & Real-World Impact
Worst Case
Attackers could upload malicious HTML/JavaScript files that execute in users' browsers when they join a server, potentially leading to account compromise, credential theft, or malware distribution.
Likely Case
Cross-site scripting (XSS) attacks where malicious scripts execute in victims' browsers, potentially stealing Discord tokens or session cookies.
If Mitigated
If proper file type validation is implemented, only legitimate image files would be accepted, preventing malicious uploads.
🎯 Exploit Status
Exploitation requires ability to upload files to the service. Public proof-of-concept demonstrates file upload with double extensions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided
Restart Required: No
Instructions:
No official patch available. Consider disabling the feature or implementing server-side file validation.
🔧 Temporary Workarounds
Disable vulnerable feature
allTurn off the 'Send an image when a user joins the server' feature in ProBot settings
Implement file validation
allAdd server-side validation to reject files with double extensions and verify actual file types
🧯 If You Can't Patch
- Disable the image upload feature entirely in ProBot configuration
- Implement a web application firewall (WAF) rule to block requests with double file extensions
🔍 How to Verify
Check if Vulnerable:
Check if ProBot version is 2021-02-08 or earlier and the image upload feature is enabledCheck Version:
Check ProBot documentation or bot settings for version informationVerify Fix Applied:
Test file upload with double extensions - they should be rejected or properly sanitized📡 Detection & Monitoring
Log Indicators:
- File upload requests with double extensions
- Requests for uploaded files with .html content type
Network Indicators:
- HTTP POST requests to upload endpoints with suspicious file names
- Subsequent requests to uploaded malicious files
SIEM Query:
http.method:POST AND (http.uri:*upload* OR http.uri:*image*) AND (http.user_agent:*ProBot* OR http.user_agent:*Discord*) AND (http.request_body:*".html." OR http.request_body:*double_extension*)🔗 References
- http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.html
- https://raw.githubusercontent.com/TheLastVvV/Vulnerability-Reports-and-CVE/main/Reports/Discord%20Probot%20-%20Unrestricted%20File%20Upload.txt
- http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.html
- https://raw.githubusercontent.com/TheLastVvV/Vulnerability-Reports-and-CVE/main/Reports/Discord%20Probot%20-%20Unrestricted%20File%20Upload.txt
