Is CVE-2022-39203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39203 being exploited in the wild.

How severe is CVE-2022-39203?

Low severity, with a CVSS score of 3.1, published 15 September 2022.

Which products and versions are affected?

matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=0.35.0.

Is there a fix for CVE-2022-39203?

Yes. matrix-appservice-irc (npm): upgrade to 0.35.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39203 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-39203?

Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39203: Matrix matrix-appservice-irc room takeover via channel name parsing

CVE-2022-39203 · Severity: low · CVSS 3.1 · Published 2022-09-15

Matrix AppService IRC is a bridge that allows Matrix users to connect to IRC channels. A parsing vulnerability in how it handles channel names allows attackers to trick the bridge into merging an attacker-controlled channel with an existing channel, granting the attacker administrative permissions in that channel. This could lead to unauthorized control of bridged chat rooms and disruption of communications.

Technologies: matrix-appservice-irc (npm). Vendors: npm.

Quick answers

Is CVE-2022-39203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39203 being exploited in the wild.
How severe is CVE-2022-39203?: Low severity, with a CVSS score of 3.1, published 15 September 2022.
Which products and versions are affected?: matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=0.35.0.
Is there a fix for CVE-2022-39203?: Yes. matrix-appservice-irc (npm): upgrade to 0.35.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39203 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-39203?: Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-appservice-irc (npm): upgrade to 0.35.0 or later
```
npm install matrix-appservice-irc@0.35.0
```

Technical details

The vulnerability is a parsing issue (CWE-266: Incorrect Privilege Assignment) in how matrix-appservice-irc processes IRC channel names. An attacker can craft a specific string of characters that confuses the bridge's channel-name normalization logic, causing it to treat an attacker-owned channel as identical to an existing target channel. When channels are merged, the attacker inherits the target channel's permissions and can perform administrative actions. The attack requires the ability to create or control an IRC channel and does not require authentication to the Matrix side. The vulnerability affects all versions prior to 0.35.0, which contains the fix.

Affected products

Matrix.org matrix-appservice-irc before 0.35.0

Identifiers

CVE-2022-39203
GHSA-xvqg-mv25-rwvw

Timeline

2022-09-13: disclosed: Security release announced
2022-09-13: patched: matrix-appservice-irc 0.35.0 released with fix
2022-09-15: advisory: GHSA-xvqg-mv25-rwvw published

References

https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.