CVE-2021-29461: LFI and possible code execution on discord-recon using tools arguments
Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround, one may copy the code from assets/CommandInjection.py in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29461?
CVE-2021-29461 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2021-29461?
To mitigate CVE-2021-29461, upgrade Discord Recon Server to version 0.0.3 or later.
What are the risks associated with CVE-2021-29461?
CVE-2021-29461 allows attackers to read and write internal files, leading to potential system compromise.
Which versions of Discord Recon Server are affected by CVE-2021-29461?
CVE-2021-29461 affects Discord Recon Server version 0.0.2 and earlier.
Can CVE-2021-29461 be exploited remotely?
Yes, CVE-2021-29461 can be exploited remotely, allowing attackers to execute commands on the vulnerable system.