Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. Patches The vulnerability has been patched in matrix-appservice-irc version 3.0.4. For more information If you have any questions or comments about this advisory, please email us at security at matrix.org.
Recommended action: Upgrade to 3.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. Patches matrix-appservice-irc 2.0.1 drops the reliance on originserverts when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. Workarounds It's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message. See these lines in the…
Recommended action: Upgrade to 2.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don't have access to. As a precondition to the attack, the malicious user needs to know the event ID of the message they want to leak, as well as to be joined to both the Matrix room and the IRC channel it is bridged to. The message reply containing the leaked message content is visible to IRC channel members when this happens. Patches matrix-appservice-irc 2.0.0 checks whether the user has permission to view an event before constructing a reply. Administrators should upgrade to this version. Workarounds It's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message. See these lines in the configuration file. References https://github.com/matrix-org/matrix-appservice-irc/pull/1799 For more information If you have any questions or comments about this…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workarounds to the bug. You can disable dynamic channels in the config to disable the most common execution method but others may exist. It is highly recommended to upgrade the bridge. Credits Discovered and reported by Val Lorentz. For more information If you have any questions or comments about this advisory email us at security@matrix.org.
Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Patches Please upgrade to 1.0.1. Workarounds You can set the matrixHandler.eventCacheSize config value to 0 to workaround this bug. However, this may impact performance. Credits Discovered and reported by Val Lorentz. For more information If you have any questions or comments about this advisory email us at security@matrix.org.
Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in matrix-appservice-irc up to 0.35.1. This vulnerability affects the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component.
Recommended action: Upgrade to 0.36.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact IRC allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. Patches The vulnerability has been patched in matrix-appservice-irc 0.35.0. Workarounds Refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command. References - https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity Credits Discovered and reported by Val Lorentz. For more information If you have any questions or comments about this advisory email us at security@matrix.org.
Recommended action: Upgrade to 0.35.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. Patched The vulnerability has been patched in matrix-appservice-irc 0.35.0. Workarounds Disable dynamic channel joining via dynamicChannels.enabled to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config. References - https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity Credits Discovered and reported by Val Lorentz. For more information If you have any questions or comments about this advisory email us at security@matrix.org.
Recommended action: Upgrade to 0.35.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.
Recommended action: Upgrade to 0.33.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.