Quest Bot, an open‑source Discord bot, contains a server‑side request forgery (SSRF) flaw in the image‑to‑GIF command. The command builds an HTTPS request by hostname after performing a public‑IP validation, then performs a second DNS lookup for the connection. An attacker who controls a domain can return a public IP during validation and an internal IP during the actual request, exploiting DNS rebinding. The flaw allows any normal server member to supply a malicious URL, making the bot contact internal or loopback services and return the response only if it is a valid image. Thus the impact is essentially blind internal probing; the bot cannot retrieve arbitrary data, only image responses, and cannot reach plain‑HTTP metadata services on other ports. The bug is fixed in version 1.1.9.

This vulnerability affects all Quest Bot installations from any version prior to 1.1.9 that are deployed on Discord servers. In those setups, every member of a server where the bot resides can trigger the flawed image‑to‑GIF command because the developer‑only gate is disabled by default. The affected product is vendor vantern‑org’s Quest Bot.

The CVSS score of 2.3 classifies the flaw as low severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a relatively modest exploitation probability. The attack vector requires an attacker to have membership in a Discord server where the bot is installed; the flaw does not persist across arbitrary external networks. In practice, the risk is confined to blind internal probing, which may help an adversary confirm the presence of internal services but does not enable direct data exfiltration. Nonetheless, the exposure warrants timely remediating action to prevent reconnaissance activity.