Is CVE-2023-38700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-38700 being exploited in the wild.

How severe is CVE-2023-38700?

Low severity, with a CVSS score of 3.1, published 4 August 2023.

Which products and versions are affected?

matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=1.0.1.

Is there a fix for CVE-2023-38700?

Yes. matrix-appservice-irc (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-38700 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-38700?

Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-38700: Matrix AppService IRC information disclosure in event handling

CVE-2023-38700 · Severity: low · CVSS 3.1 · Published 2023-08-04

Matrix AppService IRC is a bridge service that connects Matrix chat rooms with IRC networks. A vulnerability in event handling could allow an attacker with user-level access to craft malicious events that leak private message content from other bridged rooms, provided they know the target event ID. This enables unauthorized viewing of conversations from channels they shouldn't have access to.

Technologies: matrix-appservice-irc (npm). Vendors: npm.

Quick answers

Is CVE-2023-38700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-38700 being exploited in the wild.
How severe is CVE-2023-38700?: Low severity, with a CVSS score of 3.1, published 4 August 2023.
Which products and versions are affected?: matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=1.0.1.
Is there a fix for CVE-2023-38700?: Yes. matrix-appservice-irc (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-38700 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-38700?: Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-appservice-irc (npm): upgrade to 1.0.1 or later
```
npm install matrix-appservice-irc@1.0.1
```

Technical details

The vulnerability is an information disclosure issue (CWE-200) in the event caching mechanism of matrix-appservice-irc. An attacker can craft specially formed events to leak parts of targeted messages from other bridged rooms by exploiting improper message isolation in the event cache. The attack requires network-level access, low-level privileges (authenticated user), knowledge of a specific target event ID, and high attack complexity. An attacker gains the ability to read message content from other rooms. The vulnerability is fixed in version 1.0.1; administrators can also set matrixHandler.eventCacheSize to 0 as a workaround at the cost of performance impact.

Affected products

Matrix AppService IRC <= 1.0.0

Identifiers

CVE-2023-38700
GHSA-c7hh-3v6c-fj4q

Timeline

2023-08-04: disclosed
2023-08-04: patched: Version 1.0.1 released

References

https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.