Is CVE-2024-32000 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-32000 being exploited in the wild.

How severe is CVE-2024-32000?

Low severity, with a CVSS score of 3.1, published 11 April 2024.

Which products and versions are affected?

matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=2.0.0.

Is there a fix for CVE-2024-32000?

Yes. matrix-appservice-irc (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-32000 attacked?

It is attacked over the network.

Am I affected by CVE-2024-32000?

Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-32000: Matrix IRC Bridge message content information disclosure

CVE-2024-32000 · Severity: low · CVSS 3.1 · Published 2024-04-11

Matrix IRC Bridge is a service that connects Matrix chat rooms with IRC channels, allowing users on both platforms to communicate seamlessly. A vulnerability in versions before 2.0.0 allows an authenticated attacker to leak truncated content of messages they shouldn't have access to by crafting a reply to an event ID they cannot view. The leaked message becomes visible to IRC channel members, potentially exposing sensitive or private conversation content.

Technologies: matrix-appservice-irc (npm). Vendors: npm.

Quick answers

Is CVE-2024-32000 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-32000 being exploited in the wild.
How severe is CVE-2024-32000?: Low severity, with a CVSS score of 3.1, published 11 April 2024.
Which products and versions are affected?: matrix-appservice-irc (npm) SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2024-32000?: Yes. matrix-appservice-irc (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-32000 attacked?: It is attacked over the network.
Am I affected by CVE-2024-32000?: Check whether you run matrix-appservice-irc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-appservice-irc (npm): upgrade to 2.0.0 or later
```
npm install matrix-appservice-irc@2.0.0
```

Technical details

The vulnerability is an improper privilege check (CWE-280) in the message reply construction logic. When a user sends a Matrix reply to an event ID, the application fails to verify whether the user has permission to view that event before including its content in the reply message sent to the IRC bridge. An attacker must know the target event ID and be a member of both the Matrix room and its bridged IRC channel. The fix, released in version 2.0.0, adds permission validation before constructing replies. Workarounds involve configuring the reply template to exclude the original message body.

Affected products

Matrix.org matrix-appservice-irc before 2.0.0

Identifiers

CVE-2024-32000
GHSA-wm4w-7h2q-3pf7

Timeline

2024-04-11: disclosed
2024-04-11: patched: Version 2.0.0 released

References

https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-wm4w-7h2q-3pf7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.