CVE-2021-29461: high-severity vulnerability in DEMON1A Discord-Recon
LFI and possible code execution on discord-recon using tools arguments
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 2.6%
Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround, one may copy the code from `assets/CommandInjection.py` in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
DEMON1A · Discord-ReconRelated CVEs — DEMON1A Discord-Recon
In the same product, most dangerous first.
CVE-2021-21433CRITICALRemote code execution on discord-recon .dirsearch and .arjun commands due to improper input validationEPSS 3.3%CVE-2021-29465HIGHRemote file overwrite on discord-recon can result in DoS and Remote Code ExecutionEPSS 2.0%CVE-2021-29466MEDIUMPath Traversal at Discord-Recon .recon Command PathEPSS 1.6%CVE-2024-21663CRITICALRemote code execution on ReconServer due to improper input sanitization on the prips commandEPSS 1.5%