Executive brief
A vulnerability in the Matrix-to-IRC bridge allows an attacker to trick other users into executing unauthorized IRC commands. By sending a specially crafted message that a victim then replies to, the attacker can force the victim's account to perform actions on the IRC server as if the victim had typed them. This could lead to unauthorized administrative actions or account takeover on the connected IRC network.
Technical details
A CRLF injection vulnerability (CWE-93) exists in node-irc, which is used by the matrix-appservice-irc bridge. The root cause is the improper handling of Carriage Return (CR) characters in multiline messages. An attacker can craft a message containing these characters such that when a Matrix user replies to it, the bridge sends part of the reply to the IRC server as raw commands rather than a standard message. This allows for command injection on the IRC protocol level. The issue is patched in matrix-appservice-irc version 0.33.2 (and 0.34.0) and node-irc version 1.2.1.
Affected products
- Matrix.org Foundation matrix-appservice-irc <= 0.33.1
- Matrix.org Foundation node-irc <= 1.2.0
Timeline
- 2022-05-04: advisory: Vendor security release published
- 2022-05-04: patched: Fixed in matrix-appservice-irc 0.33.2/0.34.0 and node-irc 1.2.1
- 2022-05-05: disclosed: NVD publication date
References
- https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4
- https://github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6
- https://github.com/matrix-org/matrix-appservice-irc
- https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity