Headline
CVE-2022-39202: Security release of matrix-appservice-irc 0.35.0 (High severity) | Matrix.org
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.
We’ve released a new version of matrix.org’s node-irc 1.3.0 and matrix-appservice-irc 0.35.0, to patch several security issues:
- IRC mode operator confusion (Low, GHSA-cq7q-5c67-w39w)
- Parsing issue leading to room takeovers (High, GHSA-xvqg-mv25-rwvw)
- Undisclosed issue (Moderate, GHSA-r3p6-cg2c-c4qw)
The details of the final vulnerability will be released at a later date, pending an audit of the codebase to ensure it’s not affected by other similar vulnerabilities.
The vulnerabilities have been patched in node-irc version 1.3.0 and matrix-appservice-irc 0.35.0. You can get the release on Github.
The bridges running on the Libera Chat, OFTC and other networks bridged by the Matrix.org Foundation have been patched.
Please upgrade your IRC bridge as soon as possible.
The above vulnerabilities were reported by Val Lorentz. Thank you!
Related news
### Impact IRC allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. ### Patches The vulnerability has been patched in matrix-appservice-irc 0.35.0. ### Workarounds Refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command. ### References - https://matrix.org/blog/2022/09/02/security-release-of-matrix-appservice-irc-0-35-0-high-severity ### Credits Discovered and reported by [Val Lorentz](https://valentin-lorentz.fr/). ### For more information If you have any questions or comments about this advisory email us at [[email protected]](mailto:securi...