Remote Code Execution in Red Discord Bot

Vulnerability

CVE-2020-15140 is a critical remote code execution (RCE) vulnerability in the Trivia module of Red Discord Bot prior to version 3.3.11. The root cause is improper sanitization of Discord usernames when the leaderboard command processes them, allowing an attacker to inject arbitrary code [1][4].

Exploitation

An attacker only needs a Discord account with a specifically crafted username and the ability to trigger the Trivia module's leaderboard command. No additional authentication or elevated privileges are required. The exploit can be executed by any Discord user who interacts with the bot in a server where the Trivia module is enabled [4].

Impact

Successful exploitation grants the attacker arbitrary code execution on the bot's host system. This can lead to destructive actions, such as deleting files or disrupting services, and access to sensitive information, including environment variables, tokens, or other data accessible to the bot process [1][4].

Mitigation

The vulnerability is patched in Red Discord Bot version 3.3.11. As a workaround, administrators can unload the Trivia module using the unload trivia command to remove the attack vector until an update is applied [4].