CVE-2023-38690

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3	Patch
https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1	Release Notes
https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2023-08-04 17:15

Updated : 2023-08-11 18:58

NVD link : CVE-2023-38690

Mitre link : CVE-2023-38690

CVE.ORG link : CVE-2023-38690

JSON object : View

Products Affected

matrix

matrix_irc_bridge

CWE

CWE-20

Improper Input Validation

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2023-38690", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-08-04T17:15:10.783", "references": [{"url": "https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist."}, {"lang": "es", "value": "matrix-appservice-irc es un puente IRC Node.js para Matrix. Antes de la versi\u00f3n 1.0.1, era posible crear un comando con nuevas l\u00edneas que no se analizaba correctamente. Esto significaba que pod\u00edas pasar una cadena de comandos como nombre de canal, que luego ser\u00eda ejecutado por el bot del puente IRC. Las versiones 1.0.1 y superiores est\u00e1n parcheadas. No hay soluciones robustas para el fallo. Uno puede desactivar los canales din\u00e1micos en la configuraci\u00f3n para desactivar el m\u00e9todo de ejecuci\u00f3n m\u00e1s com\u00fan, pero pueden existir otros.\n"}], "lastModified": "2023-08-11T18:58:41.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:matrix:matrix_irc_bridge:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5E1ADA6C-5E11-43D2-B9D7-8357036D8621", "versionEndExcluding": "1.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}