CVE-2021-29461 - CVE House
Back to Database
Status published High CVE-2021-29461

LFI and possible code execution on discord-recon using tools arguments

Vulnerability Description

Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround, one may copy the code from `assets/CommandInjection.py` in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-29461

Credits & Attribution

No credits recorded in the NVD database.

References

More from DEMON1A

View All →
CVE-2024-21663
Remote code execution on ReconServer due to improper input sanitization on the prips command
Critical 10
CVE-2021-29466
Path Traversal at Discord-Recon .recon Command Path
Medium 6.5
CVE-2021-29465
Remote file overwrite on discord-recon can result in DoS and Remote Code Execution
High 8.3
CVE-2021-21433
Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation
Critical 9.9

Affected Vendor

Affected Software

Discord-Recon
Vulnerable Versions:
< 0.0.3

Timeline

Official Publish: April 20th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact