Executive brief
Matrix IRC Bridge is a service that connects Matrix chat rooms with IRC channels, allowing users on both platforms to communicate seamlessly. A vulnerability in versions before 2.0.0 allows an authenticated attacker to leak truncated content of messages they shouldn't have access to by crafting a reply to an event ID they cannot view. The leaked message becomes visible to IRC channel members, potentially exposing sensitive or private conversation content.
Technical details
The vulnerability is an improper privilege check (CWE-280) in the message reply construction logic. When a user sends a Matrix reply to an event ID, the application fails to verify whether the user has permission to view that event before including its content in the reply message sent to the IRC bridge. An attacker must know the target event ID and be a member of both the Matrix room and its bridged IRC channel. The fix, released in version 2.0.0, adds permission validation before constructing replies. Workarounds involve configuring the reply template to exclude the original message body.
Affected products
- Matrix.org matrix-appservice-irc before 2.0.0
Timeline
- 2024-04-11: disclosed
- 2024-04-11: patched: Version 2.0.0 released