Core Bot Sensitive Data Exposure Vulnerability in Discord Webhook Handling

A vulnerability exists in Core Bot, an open-source Discord bot for Maple Hospital servers, allowing for the unintentional leakage of sensitive API keys (SUPABASE_API_KEY, TOKEN) through error handling, summaries, and webhooks. Prior to the patch in commit dffe050, the bot's configuration summaries could expose these secrets by failing to properly redact them in summary embeds or logs. This exposure could potentially grant attackers control over the bot or its associated database.

Impact

The vulnerability could lead to the unauthorized disclosure of API keys, allowing attackers to gain control over the bot and its database.

Remediation

Users are advised to update to the latest version of Core Bot, where this vulnerability has been patched. The update can be obtained from the Core Bot GitHub repository.