Executive brief
Oceanic is a Node.js library for interacting with Discord. The library fails to properly encode user input when constructing API request URLs, allowing attackers to perform unintended API actions by injecting path traversal sequences. For example, an attacker could delete a channel instead of removing a ban by crafting malicious input containing "../../../" sequences.
Technical details
The vulnerability is a path traversal issue (CWE-22, CWE-23) in the Oceanic Discord library caused by failure to URL-encode user-supplied input before constructing REST API endpoints. Functions such as Client.rest.channels.removeBan accept unsanitized parameters that are directly concatenated into URLs. An attacker can provide specially crafted input like "../../../channels/{id}" which, when normalized by the URL parser, resolves to an unintended API path (e.g., "/api/v10/channels/{id}"), enabling execution of arbitrary API operations. The vulnerability requires the attacker to control input to affected library functions but does not require authentication or user interaction beyond the application using the malicious input. The fix, available in version 1.10.4, involves sanitizing route parameters through proper URL encoding.
Affected products
- OceanicJS oceanic.js < 1.10.4
Timeline
- 2024-05-14: disclosed
- 2024-05-14: patched: version 1.10.4