Executive brief
Matrix AppService IRC is a bridge service that connects Matrix chat rooms with IRC networks. A vulnerability in event handling could allow an attacker with user-level access to craft malicious events that leak private message content from other bridged rooms, provided they know the target event ID. This enables unauthorized viewing of conversations from channels they shouldn't have access to.
Technical details
The vulnerability is an information disclosure issue (CWE-200) in the event caching mechanism of matrix-appservice-irc. An attacker can craft specially formed events to leak parts of targeted messages from other bridged rooms by exploiting improper message isolation in the event cache. The attack requires network-level access, low-level privileges (authenticated user), knowledge of a specific target event ID, and high attack complexity. An attacker gains the ability to read message content from other rooms. The vulnerability is fixed in version 1.0.1; administrators can also set matrixHandler.eventCacheSize to 0 as a workaround at the cost of performance impact.
Affected products
- Matrix AppService IRC <= 1.0.0
Timeline
- 2023-08-04: disclosed
- 2023-08-04: patched: Version 1.0.1 released