Privilege Escalation in Channelmgnt plug-in for Sopel

Vulnerability

Overview The Channelmgnt plugin for Sopel (a Python IRC bot) contained an access control list (ACL) bypass vulnerability in versions prior to 1.0.3. The flaw allowed any malicious user to elevate their privileges to channel operator (op) or voice status, effectively bypassing intended channel management restrictions [1][4]. The same vulnerable plugin was bundled with MirahezeBot-Plugins from version 9.0.0 up to (but not including) 9.0.2 [1][2].

Exploitation

Method An attacker only needed to have access to an IRC channel where the vulnerable bot was present; no special authentication or prior privileges were required. By abusing the bug in the makemodechange self-action logic, a user could invoke commands that would cause the bot to grant them op or voice modes, even when the user lacked permission to do so [4]. The fix, introduced in pull request #3, patched the permission-checking logic to correctly validate the user's privileges before performing mode changes [3].

Impact

Successful exploitation gave the attacker full control over the channel, including the ability to kick, ban, moderate, and further promote other users. This could lead to complete channel takeover, disruption of legitimate operations, and potential data exposure if the channel was used for sensitive communications [1][4].

Mitigation

The vulnerability is fixed in Channelmgnt version 1.0.3, which is included in MirahezeBot-Plugins version 9.0.2 [1]. Users should update to these patched versions immediately. The affected repository has since been archived and is read-only [3].