CVE-2022-29166: Matrix matrix-appservice-irc CRLF injection in node-irc

CVE-2022-29166 · Severity: low · CVSS 3.1 · Published 2022-05-23

A vulnerability in the Matrix-to-IRC bridge allows an attacker to trick other users into executing unauthorized IRC commands. By sending a specially crafted message that a victim then replies to, the attacker can force the victim's account to perform actions on the IRC server as if the victim had typed them. This could lead to unauthorized administrative actions or account takeover on the connected IRC network.

Technologies: matrix-appservice-irc (npm). Vendors: npm.

Quick answers

Is CVE-2022-29166 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-29166 being exploited in the wild.
How severe is CVE-2022-29166?
Low severity, with a CVSS score of 3.1, published 23 May 2022.
Which products and versions are affected?
Matrix.org Foundation Node-Irc <= 1.2.0; matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=0.33.2.
Is there a fix for CVE-2022-29166?
Yes. matrix-appservice-irc (npm): upgrade to 0.33.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-29166 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-29166?
Check whether you run Matrix.org Foundation Node-Irc or matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-appservice-irc (npm): upgrade to 0.33.2 or later
    npm install matrix-appservice-irc@0.33.2

Technical details

A CRLF injection vulnerability (CWE-93) exists in node-irc, which is used by the matrix-appservice-irc bridge. The root cause is the improper handling of Carriage Return (CR) characters in multiline messages. An attacker can craft a message containing these characters such that when a Matrix user replies to it, the bridge sends part of the reply to the IRC server as raw commands rather than a standard message. This allows for command injection on the IRC protocol level. The issue is patched in matrix-appservice-irc version 0.33.2 (and 0.34.0) and node-irc version 1.2.1.

Affected products

  • Matrix.org Foundation matrix-appservice-irc <= 0.33.1
  • Matrix.org Foundation node-irc <= 1.2.0

Identifiers

  • CVE-2022-29166
  • GHSA-37hr-348p-rmf4

Timeline

  • 2022-05-04: advisory: Vendor security release published
  • 2022-05-04: patched: Fixed in matrix-appservice-irc 0.33.2/0.34.0 and node-irc 1.2.1
  • 2022-05-05: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.