CVE-2020-15147 High · 8.5 EPSS 2.6%

Remote Code Execution in Red Discord Bot

Cog-Creators · Red-DiscordBot

Official description · CVE.org

Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.

Breakdown

23.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Get in through VPN or remote-access servicesT1133 · External Remote ServicesSource data20 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules

Disclosed on 21 Aug 2020. No public exploit code or confirmed exploitation is recorded.

4 fixes in Red-DiscordBot over 4 years. The latest fix listed for Red-DiscordBot is 3.5.10.

Fixes in Red-DiscordBotPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

3.3.11CVE-2020-1514021 Aug 2020
3.3.12CVE-2020-1514721 Aug 2020
3.4.1CVE-2020-1527828 Oct 2020
3.5.10CVE-2024-3990511 Jul 2024Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

External Remote Services T1133 also Persistence

MITRE CTID mapping of the CVE · how it is exploited

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 115 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-15147 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

External Remote ServicesT113320 general rules

External Remote SMB Logon from Public IPhightest
OpenCanary - SSH Login Attempthightest
OpenCanary - SSH New Connection Attempthightest
OpenCanary - Telnet Login Attempthightest
Running Chrome VPN Extensions via the Registry 2 VPN Extensionhightest
Unusual Child Process of dns.exehightest
Unusual File Deletion by Dns.exehightest
Unusual File Modification by dns.exehightest

All 20 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Red-DiscordBot.

PyPIRed-DiscordBotGHSA-7257-96vg-qf6x PYSEC-2020-266

Upgrade to 3.3.12 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2020-15140).

pippip install "Red-DiscordBot>=3.3.12"

The first fix for CVE-2020-15147.

Affected versions

If you run	Upgrade to
All versions before 3.3.12	3.3.12

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x

x_refsource_MISC 2

github.com/Cog-Creators/Red-DiscordBot/pull/4183 github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18431b1df38a9be92bfc

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0164

No public exploit code found.

, 30 Oct 2026

2.6%Top 15%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 85.4%).

3.1

8.5High · 8.5

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.8541 17.1/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 8.5 6.0/7

End-of-life productsupported or unknown 0.0

Total23.0

Record

Published: 21 Aug 2020
Modified: 4 Aug 2024
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.