CVE-2024-21663: Remote code execution on ReconServer due to improper input sanitization on the prips command

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-09 · updated 2026-06-17
Weakness: CWE-20

Description

Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

Affected products

DEMON1A Discord-Recon: before 0.0.8; 0.0.8-beta — fixed in 0.0.8

How to fix

Upgrade to a fixed version: DEMON1A Discord-Recon 0.0.8. Check the vendor advisory for mitigations.

References

https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a
https://github.com/DEMON1A/Discord-Recon/issues/23
https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7
https://github.com/DEMON1A/Discord-Recon/commit/f9cb0f67177f5e2f1022295ca8e641e47837ec7a
https://github.com/DEMON1A/Discord-Recon/issues/23
https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-fjcj-g7x8-4rp7

Get alerted when CVE-2024-21663 or the next vulnerability affects your stack