PT-2023-26556 · Unknown · Matrix-Appservice-Bridge
Half-Shot
·
Publicado
2023-08-04
·
Atualizado
2023-08-11
·
CVE-2023-38691
CVSS v3.1
5.0
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
matrix-appservice-bridge versions 4.0.0 through 8.1.1
matrix-appservice-bridge versions 9.0.0
Description
A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the
sub parameter (containing the user's claimed MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a sub parameter according to the user they want to act as and use the resulting token to perform provisioning requests.Recommendations
For matrix-appservice-bridge versions 4.0.0 through 8.1.1, update to version 8.1.2 or later.
For matrix-appservice-bridge version 9.0.0, update to version 9.0.1 or later.
As a temporary workaround, consider disabling the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.
Exploit
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Matrix-Appservice-Bridge