Description
The matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don’t have access to.
Recommendation
Update the matrix-appservice-irc package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.0
- Patched version(s): 2.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Matrix IRC Bridge truncated content of messages can be leaked and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
- Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
- Improper handling of multiline messages in node-irc affects matrix-appservice-irc - CVE-2022-29166
You might also like:
See something that needs correcting? Let us knowUpdated April 15, 2024