CVE-2023-38690: medium-severity vulnerability in matrix-org matrix-appservice-irc
matrix-appservice-irc IRC command injection via admin commands containing newlines
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.8epss 0.9%
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Affected products
matrix-org · matrix-appservice-ircRelated CVEs — matrix-org matrix-appservice-irc
In the same product, most dangerous first.
CVE-2022-29166HIGHImproper handling of multiline messages in matrix-appservice-ircEPSS 1.0%CVE-2022-39202MEDIUMIRC mode parameter confusion in matrix-appservice-ircEPSS 0.9%CVE-2022-39203HIGHParsing issue in matrix-org/node-irc leading to room takeoversEPSS 0.9%CVE-2023-38700LOWmatrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged roomsEPSS 0.6%CVE-2024-39691MEDIUMMalicious Matrix homeserver can leak truncated message content of messages it shouldn't have access toEPSS 0.5%CVE-2024-32000MEDIUMTruncated content of messages can be leaked from matrix-appservice-ircEPSS 0.5%