Roblox Purchasing Hub CVEs and Security Vulnerabilities

CVE-2024-31442

Redon-Hub has incorrect permissions on all admin related commands

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redon

Products

Roblox Purchasing Hub

CVE-2021-41191

API giving out files without key

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed