The !verify command accepts a username as the first parameter, which is used to lookup a user on an LDAP server. It's possible to do !verify * random@email.here.com (the username being a wildcard), and have brickbot cycle through every single user on the LDAP server to see if the email random@email.here.com matches their altmail. If it so happens that the email is associated with any username in the database, it'll grant you access to the Discord server. It may also be possible to craft other strings to send to the LDAP server, as presently, brickbot just injects user input into the search string.
I think the easiest way to fix this is to use an EqualityFilter as the filter key in https://github.com/redbrick/brickbot/blob/master/commands/verify.js#L19, but I don't have the time to test it.
The
!verifycommand accepts a username as the first parameter, which is used to lookup a user on an LDAP server. It's possible to do!verify * random@email.here.com(the username being a wildcard), and have brickbot cycle through every single user on the LDAP server to see if the emailrandom@email.here.commatches their altmail. If it so happens that the email is associated with any username in the database, it'll grant you access to the Discord server. It may also be possible to craft other strings to send to the LDAP server, as presently, brickbot just injects user input into the search string.I think the easiest way to fix this is to use an
EqualityFilteras thefilterkey in https://github.com/redbrick/brickbot/blob/master/commands/verify.js#L19, but I don't have the time to test it.