Executive brief
Matrix AppService IRC is a bridge that allows Matrix users to connect to IRC channels. A parsing vulnerability in how it handles channel names allows attackers to trick the bridge into merging an attacker-controlled channel with an existing channel, granting the attacker administrative permissions in that channel. This could lead to unauthorized control of bridged chat rooms and disruption of communications.
Technical details
The vulnerability is a parsing issue (CWE-266: Incorrect Privilege Assignment) in how matrix-appservice-irc processes IRC channel names. An attacker can craft a specific string of characters that confuses the bridge's channel-name normalization logic, causing it to treat an attacker-owned channel as identical to an existing target channel. When channels are merged, the attacker inherits the target channel's permissions and can perform administrative actions. The attack requires the ability to create or control an IRC channel and does not require authentication to the Matrix side. The vulnerability affects all versions prior to 0.35.0, which contains the fix.
Affected products
- Matrix.org matrix-appservice-irc before 0.35.0
Timeline
- 2022-09-13: disclosed: Security release announced
- 2022-09-13: patched: matrix-appservice-irc 0.35.0 released with fix
- 2022-09-15: advisory: GHSA-xvqg-mv25-rwvw published