CVE-2024-39691: matrix-org matrix-appservice-irc

Vulnerability summary

CVE-2024-39691 is a medium (CVSS 4.3) vulnerability in matrix-org matrix-appservice-irc. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.

Timeline

1. 05-07-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.

• CWE-280Improper Handling of Insufficient Permissions or PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
• CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.