CVE-2021-37696
📋 TL;DR
This vulnerability in tmerc-cogs for Red Discord bot allows any user to access sensitive information by crafting a specific MassDM message. It affects all users running vulnerable versions of the MassDM cog. The issue stems from missing authentication checks in the MassDM command implementation.
💻 Affected Systems
- tmerc-cogs MassDM cog for Red Discord bot
📦 What is this software?
Tmerc Cogs by Tmerc Cogs Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive bot configuration data, user information, or server secrets through crafted messages, potentially leading to account compromise or data breaches.
Likely Case
Malicious users exploiting the vulnerability to access bot tokens, API keys, or other configuration secrets stored in the bot's environment.
If Mitigated
With proper access controls and monitoring, impact would be limited to unauthorized information disclosure that can be quickly detected and contained.
🎯 Exploit Status
Exploitation requires crafting specific MassDM messages but does not require authentication. The advisory provides enough detail for attackers to develop exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 92325be650a6c17940cc52611797533ed95dbbe1
Vendor Advisory: https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-ffhm-9c8j-wx9h
Restart Required: Yes
Instructions:
1. Update tmerc-cogs to commit 92325be650a6c17940cc52611797533ed95dbbe1 or later. 2. Restart the Red Discord bot. 3. Verify the MassDM cog loads without errors.
🔧 Temporary Workarounds
Unload MassDM Cog
allTemporarily disable the vulnerable MassDM cog until patching is possible
[p]unload massdm
Disable MassDM Command
allGlobally disable the vulnerable command while keeping other cog functionality
[p]disable global massdm
🧯 If You Can't Patch
- Immediately unload the MassDM cog using [p]unload massdm command
- Implement strict access controls and monitor for unusual MassDM command usage
🔍 How to Verify
Check if Vulnerable:
Check if MassDM cog is loaded and if commit hash is earlier than 92325be650a6c17940cc52611797533ed95dbbe1Check Version:
Check git log or cog version information in botVerify Fix Applied:
Verify current commit hash is 92325be650a6c17940cc52611797533ed95dbbe1 or later, and test that MassDM command requires proper permissions📡 Detection & Monitoring
Log Indicators:
- Unauthorized MassDM command usage
- Unusual patterns in MassDM message sending
- Access to sensitive configuration commands by non-admins
Network Indicators:
- Unusual Discord API calls from bot related to MassDM functionality
SIEM Query:
Search for 'massdm' command usage by non-administrative users in bot logs🔗 References
- https://github.com/tmercswims/tmerc-cogs/commit/92325be650a6c17940cc5
- https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-ffhm-9c8j-wx9h
- https://github.com/tmercswims/tmerc-cogs/commit/92325be650a6c17940cc5
- https://github.com/tmercswims/tmerc-cogs/security/advisories/GHSA-ffhm-9c8j-wx9h
