Parsing issue in matrix-org/node-irc leading to room takeovers

高 8.8CVE-2022-39203 · GHSA-xvqg-mv25-rwvw · 13/09/2022 公開 · 17/06/2026 更新

要点

CVE-2022-39203 は matrix irc bridge (matrix), matrix-appservice-irc に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.86%（全脆弱性の 58.6% より高い）。
対処：0.35.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
matrix irc bridge matrix	`< 0.35.0`	`0.35.0`
matrix-appservice-irc npm	`< 0.35.0`	`0.35.0`

概要

Impact

Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel.

Patched

The vulnerability has been patched in matrix-appservice-irc 0.35.0.

Workarounds

Disable dynamic channel joining via dynamicChannels.enabled to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.

References

https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity

Credits

Discovered and reported by Val Lorentz.

For more information

If you have any questions or comments about this advisory email us at [email protected].

NVD の説明

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via `dynamicChannels.enabled` to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.