Description
It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target.
Recommendation
Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0
- Patched version(s): 1.0.1
References
Could your website be exposed too?
SmartScanner can check your website for matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper handling of multiline messages in node-irc affects matrix-appservice-irc - CVE-2022-29166
- matrix-appservice-irc IRC command injection via admin commands containing newlines - CVE-2023-38690
- Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691
- Matrix IRC Bridge truncated content of messages can be leaked - CVE-2024-32000
You might also like:
See something that needs correcting? Let us knowUpdated November 12, 2023