[CVE-2020-15853] anyone can run the "refresh" command

fedora-infra / supybot-fedora

Fedora plugin for Supybot

20 stars 23 forks source link

[CVE-2020-15853] anyone can run the "refresh" command #69

Open ryanlerch opened 3 years ago

ryanlerch commented 3 years ago

supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding to requests during this time.

However, anyone is able to run this command and make zodbot stop responding for (in my testing about 20-30 minutes). This command should be for bot owners only

ryanlerch commented 2 years ago

refreshing the cache is a lot faster now that zodbot uses fasjson / noggin / fedora accounts to fill this cache, but we should still make it an admin command.