CVE-2023-38690 MEDIUM

CVE-2023-38690: matrix-appservice-irc IRC command injection via admin commands containing newlines

Vendor Matrix-Org
Product matrix-appservice-irc
Weakness CWE-20 · Input validation
Published August 4, 2023
Last update October 8, 2024
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

Key dates

02Disclosure timeline

August 4, 2023 CVE published
October 8, 2024 Record updated