Security vulnerabilities and automated fixes for plugin security issues
3 posts found
The `disableReminder` method in the `SchedulePush` class allowed any user to disable push notification reminders for arbitrary user IDs by manipulating the `e.user_id` event parameter. The fix adds a `checkFriend()` authorization gate that verifies the requesting user has a valid friendship relationship with the bot before modifying subscription state.
A plugin manager service exposed an `installPlugin(plugin: PluginInfo)` method that passed `plugin.packageName` and `plugin.version` straight into the platform's npm install routine with no validation, no blocklist, and no integrity verification of the fetched tarball. Because npm treats a non-semver "version" as a fetch specifier — a tarball URL, a git ref, a local path — an attacker who could influence the plugin listing could get arbitrary code installed and executed with full Electron/Node p
A critical buffer overflow vulnerability was discovered and patched in plugin.c, where five unbounded sprintf() calls wrote into fixed-size buffers without validating input length. An attacker controlling NVMe device names or plugin metadata could exploit this to overwrite return addresses and achieve arbitrary code execution. The fix eliminates these unsafe calls, closing a classic but devastatingly effective attack vector.