matrix-appservice-irc IRC command injection via admin commands containing newlines
CVE-2023-38690

5.8MEDIUM

Key Information:

Vendor

Matrix-org

Status
Matrix-appservice-irc
Vendor
CVE Published:
4 August 2023

What is CVE-2023-38690?

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

Affected Version(s)

matrix-appservice-irc < 1.0.1

References

https://github.com/matrix-org/matrix-appservice-irc/secur...
x_refsource_CONFIRM
https://github.com/matrix-org/matrix-appservice-irc/commi...
x_refsource_MISC
https://github.com/matrix-org/matrix-appservice-irc/relea...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.