Bee Swarm Simulator Macro Allows Unauthorized Access to Computers

Summary

If you use the Bee Swarm Simulator macro with Discord Remote Control in a public chat channel, hackers could take control of your computer and access your files. This is fixed in version 1.1.0 of the macro. Update to the latest version to protect your computer.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
natroteam	natro_macro	<= 1.1.0	–

Original title

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user wi...

Original description

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user with the permission to send message in said channel access to do anything on their computer. This includes keyboard and mouse inputs and full file access. This issue has been patched in version 1.1.0.

nvd CVSS3.1 6.4

Vulnerability type

CWE-22 Path Traversal

CWE-287 Improper Authentication

CWE-434 Unrestricted File Upload

https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-ph9r-2qjm-ghvg