// For flags

CVE-2024-39691

Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.

Matrix-appservice-irc es un puente IRC de Node.js para el protocolo de mensajería Matrix. La solución para GHSA-wm4w-7h2q-3pf7/CVE-2024-32000 incluida en Matrix-appservice-irc 2.0.0 se basaba en la marca de tiempo proporcionada por el servidor doméstico de Matrix para determinar si un usuario tiene acceso al evento al que está respondiendo cuando determina si se incluye o no una versión truncada del evento original en el mensaje IRC. Dado que este valor está controlado por entidades externas, un servidor doméstico Matrix malicioso unido a una sala en la que está presente una instancia de puente Matrix-appservice-irc (anterior a la versión 2.0.1) puede fabricar la marca de tiempo con la intención de engañar al puente para fugar mensajes de la sala, mensajes a los que el servidor doméstico no debería tener acceso. Matrix-appservice-irc 2.0.1 elimina la dependencia de `origin_server_ts` al determinar si un evento debe ser visible o no para un usuario, en lugar de realizar un seguimiento interno de las marcas de tiempo del evento. Como solución alternativa, es posible limitar la cantidad de información filtrada configurando una plantilla de respuesta que no contenga el mensaje original.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-06-27 CVE Reserved
  • 2024-07-05 CVE Published
  • 2024-07-06 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-280: Improper Handling of Insufficient Permissions or Privileges
  • CWE-755: Improper Handling of Exceptional Conditions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Matrix-org
Search vendor "Matrix-org"
 Matrix-appservice-irc
Search vendor "Matrix-org" for product "Matrix-appservice-irc"
 < 2.0.1
Search vendor "Matrix-org" for product "Matrix-appservice-irc" and version " < 2.0.1"
en
Affected