Oceanic Fixes Input Normalization Vulnerability in Discord API

CVE-2024-34712

Summary

The Oceanic library for NodeJS, designed for interfacing with the Discord API, contains a vulnerability in versions prior to 1.10.4. The flaw arises from the library not properly URL-encoding inputs to functions, specifically in Client.rest.channels.removeBan. This allows an attacker to manipulate input values such as ../../../channels/{id}, which normalizes into an unintended URL /api/v10/channels/{id} leading to the deletion of channels instead of the intended action of removing a ban. Users of the library are advised to upgrade to version 1.10.4 or later. Alternative mitigation strategies include sanitizing user input and utilizing encodeURIComponent to ensure inputs are valid before they are processed by the library.

References