matrix-org matrix-appservice-irc up to 2.0.0 insufficient permissions or privileges

Summaryinfo

A vulnerability classified as problematic was found in matrix-org matrix-appservice-irc up to 2.0.0. Impacted is an unknown function. The manipulation results in insufficient permissions or privileges. This vulnerability is identified as CVE-2024-39691. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in matrix-org matrix-appservice-irc up to 2.0.0. Affected is an unknown function. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. CWE is classifying the issue as CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. This is going to have an impact on confidentiality. CVE summarizes:

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-39691 since 06/27/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1222.

Upgrading to version 2.0.1 eliminates this vulnerability. Applying the patch 1835e047f269001054be4c68867797aa12372a0f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Vendor

• matrix-org

Name

• matrix-appservice-irc

Version

• 2.0

License

• open-source

Website

• Product: https://github.com/matrix-org/matrix-appservice-irc/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion