Executive brief
Matrix-appservice-bridge is a library used to connect the Matrix communication platform with other chat services. A vulnerability in how it handles room upgrades allows a malicious room administrator to secretly redirect chat traffic to a different room without the consent or knowledge of the participants in the new room. This could lead to unauthorized access to conversations or the hijacking of bridged chat channels.
Technical details
A vulnerability exists in matrix-appservice-bridge versions 2.6.0 and earlier when the 'roomUpgradeOpts' configuration is enabled. The bridge's automatic room upgrade handler processes 'm.room.tombstone' events to transition to a new room but fails to verify that the 'm.room.create' event of the target room contains a 'predecessor' field pointing back to the original room. A malicious administrator of a bridged room can exploit this to unbridge the current room and bridge into an arbitrary target room without the target room's consent. This is classified as a missing authentication for a critical function (CWE-306). The issue is fixed in version 2.6.1 by adding a check to ensure the target room's predecessor matches the old room ID.
Affected products
- Matrix.org matrix-appservice-bridge <= 2.6.0
Timeline
- 2021-05-28: other: Fix commit authored
- 2021-06-02: patched: Version 2.6.1 released
- 2021-06-16: disclosed: Security advisory published
- 2021-06-21: advisory: GHSA published
References
- https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx
- https://github.com/matrix-org/matrix-appservice-bridge/pull/330
- https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9f
- https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1