Server-side request forgery in Quest Bot image to GIF command
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Quest Bot before 1.1.9 has a server-side request forgery flaw (CWE-918) in its image to GIF command. The command checks that a hostname resolves to public addresses but then connects by hostname, so DNS rebinding can reach internal addresses. Any server member can trigger it without special permissions, mostly for blind internal probing, since requests are limited to HTTPS on port 443 and only genuine image responses are returned.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through `DNS rebinding`. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to `HTTPS on port 443`, and content is returned only when the response is a `genuine image`. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vantern-org | questbot | before 1.1.9 | 1.1.9 | Patch available | CNA |
- questbot Vendorvantern-org Affected before 1.1.9 Fixed in 1.1.9 Patch available CNA
Remediation
Update Quest Bot to version 1.1.9, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA questbot (vantern-org) Fixed in 1.1.9
Timeline
- 2026-10-30 Threatist record created from CVE-2026-61840
- 2026-10-30 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences