Executive brief
node-irc is a Node.js library that implements the IRC (Internet Relay Chat) protocol and is used by Matrix to bridge IRC networks. The vulnerability allows an attacker to trick a Matrix user into executing arbitrary IRC commands by crafting a malicious message with improperly handled carriage return (CR) characters. This could result in unauthorized command execution on IRC servers and potential compromise of the user's IRC session.
Technical details
The vulnerability is a CRLF injection (CWE-93) in node-irc's message parsing logic. The root cause is improper handling of carriage return (CR) characters when splitting multiline messages. An attacker can craft a message containing CR characters that, when a Matrix user replies to it, causes part of the message to be sent verbatim to the IRC server rather than as a normal channel message. This allows injection of arbitrary IRC protocol commands (e.g., PRIVMSG, MODE, KICK) without the user's knowledge. The attack requires user interaction (a Matrix user must reply to the malicious message) and the victim must be using the vulnerable node-irc library through Matrix-appservice-irc. The vulnerability has been patched in node-irc version 1.2.1 and matrix-appservice-irc version 0.34.0, where message splitting was corrected to handle CR, LF, and CRLF sequences properly.
Affected products
- matrix-org node-irc <= 1.2.0
Timeline
- 2022-05-04: disclosed
- 2022-05-05: patched: node-irc 1.2.1 and matrix-appservice-irc 0.34.0 released
References
- https://github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6
- https://github.com/matrix-org/node-irc/commit/2976c856df37660a9d664e94c857c796de2e34f7
- https://github.com/matrix-org/node-irc/commit/e3eb9c15f8240e9c92365f5ffc3944469229771b
- https://github.com/matrix-org/node-irc
- https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity