Description
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sharkord sharkord
Default version status: unaffected
0 to < 0.0.26affected
References
- https://github.com/Sharkord/sharkord/issues/387 ↗
- https://github.com/Sharkord/sharkord/issues/851 ↗
- https://github.com/Sharkord/sharkord/commit/fd15061eaf366c7150325780a2d7b4b452f1134f ↗
- https://github.com/Sharkord/sharkord/releases/tag/v0.0.26 ↗
- https://github.com/Sharkord/sharkord/blob/v0.0.25/apps/server/src/routers/others/change-logo.ts ↗
- https://www.vulncheck.com/advisories/sharkord-before-0.0.26-missing-authorization-via-changelogo-trpc-route ↗