Executive brief
sopel-plugins.channelmgnt is an IRC bot plugin that manages channel operations like kicking and banning users. The plugin contains improper input validation in its kick/ban command logic, allowing an attacker with high privileges (typically a channel operator) to bypass restrictions that normally protect the bot from being removed from a channel by kicking multiple users in a single command. This could lead to disruption of the bot's operations and potential unauthorized user removal from affected channels.
Technical details
The vulnerability is an improper input validation issue (CWE-20) combined with improper access control (CWE-284) in the kick/ban command handlers. On IRC servers where TARGMAX is greater than 1 (allowing multiple targets in a single command), an attacker with channel operator privileges can craft a multi-user kick command that bypasses the bot's self-protection logic and removal restrictions. The attack requires high privileges and user interaction (sending the command), affecting channel integrity and availability. The vulnerability was patched in version 2.0.1; users on networks where TARGMAX > 1 should upgrade immediately or disable the plugin.
Affected products
- MirahezeBots sopel-plugins.channelmgnt <2.0.1
Timeline
- 2021-04-09: disclosed
- 2021-04-09: patched: Version 2.0.1 released