Is CVE-2023-38691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-38691 being exploited in the wild.

How severe is CVE-2023-38691?

Low severity, with a CVSS score of 3.1, published 4 August 2023.

Which products and versions are affected?

Matrix.org AppService Bridge 4.0.0 through 9.0.0 (fixed in 8.1.2 and 9.0.1+).

Is there a fix for CVE-2023-38691?

A patch was published on 2023-08-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-38691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-38691?

Check whether you run Matrix.org AppService Bridge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-38691: Matrix AppService Bridge OpenID token subject verification bypass

CVE-2023-38691 · Severity: low · CVSS 3.1 · Published 2023-08-04

Matrix AppService Bridge is a library used to connect third-party applications and services to the Matrix communication protocol. A flaw in OpenID token validation allows a malicious Matrix server to impersonate any user and gain unauthorized access to provisioning APIs, potentially enabling account takeover or unauthorized modifications in connected services.

Vendors: Matrix.org.

Quick answers

Is CVE-2023-38691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-38691 being exploited in the wild.
How severe is CVE-2023-38691?: Low severity, with a CVSS score of 3.1, published 4 August 2023.
Which products and versions are affected?: Matrix.org AppService Bridge 4.0.0 through 9.0.0 (fixed in 8.1.2 and 9.0.1+).
Is there a fix for CVE-2023-38691?: A patch was published on 2023-08-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-38691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-38691?: Check whether you run Matrix.org AppService Bridge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authentication flaw (CWE-287) in the OpenID token exchange mechanism. The library fails to verify that the servername portion of the OpenID 'sub' parameter (which contains the user's claimed MXID) matches the servername of the Matrix server handling the exchange. An attacker controlling a malicious Matrix server can craft an OpenID response with a forged 'sub' parameter impersonating any user and use the resulting token to make unauthorized provisioning API calls. The attack requires the provisioning API to be enabled and network access to the vulnerable bridge; exploitation requires low privileges (authentication to the attacker-controlled Matrix server). Patches are available in versions 8.1.2 and 9.0.1 or later.

Affected products

Matrix.org AppService Bridge 4.0.0 through 9.0.0 (fixed in 8.1.2 and 9.0.1+)

Identifiers

CVE-2023-38691
GHSA-vc7j-h8xg-fv5x

Timeline

2023-08-04: disclosed
2023-08-04: patched

References

https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.