CVE-2024-31442: Redon Hub Auth Bypass Vulnerability

CVE-2024-31442 Overview

CVE-2024-31442 is a missing authorization vulnerability [CWE-276] in Redon Hub, a Discord-based Roblox product delivery bot. In all versions before 1.0.2, every slash command executes for any user regardless of privilege level. Attackers can invoke administrative commands intended for bot owners, granting themselves free products and manipulating product, tag, and configuration data. The only command not affected is /products admin clear, which was already restricted to bot owners. Maintainers released version 1.0.2 with proper permission checks on all command handlers.

Critical Impact
Any Discord user with access to the bot can execute admin commands, receive paid Roblox products for free, and create, update, or delete products and tags.

Affected Products

Redon Roblox Purchasing Hub (Redon Hub) versions prior to 1.0.2
Discord bot component bot/__init__.py
Product command cog bot/cogs/product.py

Discovery Timeline

2024-04-08 - CVE-2024-31442 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31442

Vulnerability Analysis

Redon Hub exposes its administrative functionality through Discord application commands (slash commands). The bot's command handlers did not verify caller identity or role membership before executing privileged actions. As a result, any Discord user in a server hosting the bot could invoke commands that were only intended for bot owners or administrators.

The abusable functionality includes commands that grant Roblox products to a user, create new products, update existing products, and delete products or tags. Because product delivery is the bot's core purpose, missing authorization directly translates into financial loss for hub operators and full tampering of the product catalog.

The issue is categorized as Incorrect Default Permissions [CWE-276]. Commands inherited Discord's default "visible to everyone" behavior instead of enforcing an application-layer permission check on the interaction context.

Root Cause

The root cause is the absence of a permission decorator or explicit owner check in the affected command callbacks. Only /products admin clear implemented an owner-only guard. Every other command relied on Discord's UI to hide options from non-admins, which does not prevent execution when the command is invoked directly.

Attack Vector

An authenticated Discord user shares a guild with a vulnerable Redon Hub deployment. The user types an administrative slash command such as one that gifts a product to their own account. The bot processes the interaction without validating that the invoker holds the bot-owner role and completes the privileged action.

python

# Patch excerpt from bot/__init__.py (V1.0.2)
# Source: https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd

-from discord import Object as DiscordObject
+from discord import Interaction, Embed
 from discord.ext.commands import Bot as BotBase
+from discord.app_commands import AppCommandError, MissingPermissions
 from . import config
 from .data import database
 from glob import glob
 import logging
 import os
+import datetime

 _log = logging.getLogger(__name__)
-__version__ = "1.0.0"
+__version__ = "1.0.2"

The fix imports AppCommandError and MissingPermissions from discord.app_commands and introduces global handling for permission failures. A parallel change in bot/cogs/product.py restructures the product command imports to support new permission checks on each product-related handler.

Detection Methods for CVE-2024-31442

Indicators of Compromise

Discord audit log entries showing product-grant, product-create, product-update, or product-delete slash commands executed by users without the bot-owner role
Unexpected Roblox product deliveries recorded in the hub's database without a corresponding purchase transaction
New or modified product and tag records in the bot's database that do not match operator activity
Bot version string reporting 1.0.0 or 1.0.1 in logs or bot/__init__.py

Detection Strategies

Compare Discord interaction logs against the bot's product delivery database to find grants without matching payment records.
Alert on any successful invocation of admin-tier commands by user IDs outside an approved owner allowlist.
Track the deployed Redon Hub version across environments and flag any host still running a release below 1.0.2.

Monitoring Recommendations

Forward Discord bot logs and the hub's application logs into a centralized log store for correlation with Roblox purchase records.
Enable Discord server audit logging and retain slash command usage history for post-incident review.
Review product catalog change events daily until all instances are confirmed upgraded to 1.0.2.

How to Mitigate CVE-2024-31442

Immediate Actions Required

Upgrade all Redon Hub deployments to version 1.0.2 or later, which enforces owner-only permissions on admin commands.
Audit product delivery and catalog change history for unauthorized activity that occurred while running an affected version.
Rotate any Discord bot tokens and Roblox API credentials that may have been exposed through unauthorized command execution.

Patch Information

The fix is delivered in Redon Hub version 1.0.2 through commit 38cb7c08d4d890e8a1badadbd46f459f06e3cdcd. See the GitHub Security Advisory GHSA-3rx8-6453-7q26 and the upstream patch commit for full details.

Workarounds

If patching is delayed, take the bot offline until version 1.0.2 can be deployed.
Restrict the Discord server hosting the bot to trusted members only, minimizing the attacker population.
Remove admin command registrations from the guild command tree until the update is applied.

bash

# Upgrade Redon Hub to the patched release
git fetch --tags
git checkout v1.0.2
pip install -r requirements.txt
# Restart the bot service
systemctl restart redon-hub