CVE-2024-31442 - Vulnerability Details - OpenCVE

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00069.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-29331	Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd
https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-04-08T15:33:19.831Z

Updated: 2024-08-02T01:52:56.942Z

Reserved: 2024-04-03T17:55:32.645Z

Link: CVE-2024-31442

Vulnrichment

Updated: 2024-05-23T19:01:22.880Z

NVD

Status : Awaiting Analysis

Published: 2024-04-08T16:15:07.990

Modified: 2024-11-21T09:13:31.740

Link: CVE-2024-31442

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31442", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-03T17:55:32.645Z", "datePublished": "2024-04-08T15:33:19.831Z", "dateUpdated": "2024-08-02T01:52:56.942Z"}, "containers": {"cna": {"title": "Redon-Hub has incorrect permissions on all admin related commands", "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "lang": "en", "description": "CWE-276: Incorrect Default Permissions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26"}, {"name": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd", "tags": ["x_refsource_MISC"], "url": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd"}], "affected": [{"vendor": "Redon-Tech", "product": "Redon-Hub", "versions": [{"version": "< 1.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-08T15:33:19.831Z"}, "descriptions": [{"lang": "en", "value": "Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch."}], "source": {"advisory": "GHSA-3rx8-6453-7q26", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T18:37:15.444866Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:37:19.640Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:52:56.942Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26"}, {"name": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd"}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31442", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-03T17:55:32.645Z", "datePublished": "2024-04-08T15:33:19.831Z", "dateUpdated": "2024-06-04T17:37:19.640Z"}, "containers": {"cna": {"title": "Redon-Hub has incorrect permissions on all admin related commands", "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "lang": "en", "description": "CWE-276: Incorrect Default Permissions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26"}, {"name": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd", "tags": ["x_refsource_MISC"], "url": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd"}], "affected": [{"vendor": "Redon-Tech", "product": "Redon-Hub", "versions": [{"version": "< 1.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-08T15:33:19.831Z"}, "descriptions": [{"lang": "en", "value": "Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch."}], "source": {"advisory": "GHSA-3rx8-6453-7q26", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T18:37:15.444866Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.880Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"descriptions": [{"lang": "en", "value": "Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch."}, {"lang": "es", "value": "Redon Hub es un robot de entrega de productos de Roblox, tambi\u00e9n conocido como Hub. En todos los centros anteriores a la versi\u00f3n 1.0.2, todos los usuarios pueden ejecutar todos los comandos, incluidos los comandos de administrador. Esto permite a los usuarios recibir productos de forma gratuita y eliminar/crear/actualizar productos/etiquetas/etc. El \u00fanico comando no afectado es `/products admin clear`, ya que ya estaba programado solo para propietarios de bots. Todos los usuarios deben actualizar a la versi\u00f3n 1.0.2 para recibir un parche."}], "id": "CVE-2024-31442", "lastModified": "2024-11-21T09:13:31.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-08T16:15:07.990", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd"}, {"source": "security-advisories@github.com", "url": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "security-advisories@github.com", "type": "Secondary"}]}