Description
matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2.
Recommendation
Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.33.1
- Patched version(s): 0.33.2
References
Could your website be exposed too?
SmartScanner can check your website for Improper handling of multiline messages in node-irc affects matrix-appservice-irc and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
- Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971
- matrix-appservice-irc vulnerable to IRC mode parameter confusion - CVE-2022-39202
- Parsing issue in matrix-org/node-irc leading to room takeovers - CVE-2022-39203
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023