PT-2021-19837 · Unknown · Matrix-Appservice-Bridge

Half-Shot · Published 2021-06-16 · Updated 2021-07-09 · CVE-2021-32659

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Matrix-appservice-bridge versions 2.6.0 and earlier

Description The issue concerns the Matrix communication program's application services, specifically the bridging service. If a bridge has room upgrade handling turned on in the configuration, any m.room.tombstone event encountered will be used to unbridge the current room and bridge into the target room. However, the target room m.room.create event is not checked to verify if the predecessor field contains the previous room. This allows any malicious admin of a bridged room to repoint the traffic to a different room without the new room being aware.

Recommendations For versions 2.6.0 and earlier, update to version 2.6.1 or greater to resolve the issue. As a temporary workaround for versions 2.6.0 and earlier, consider disabling the automatic room upgrade handling by removing the roomUpgradeOpts key from the Bridge class options.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-32659

GHSA-35G4-QX3C-VJHX

Affected Products

Matrix-Appservice-Bridge

References · 8

• https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1 · Patch
• https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9f · Patch
• https://osv.dev/vulnerability/GHSA-35g4-qx3c-vjhx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32659 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32659 · Vendor Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx · Note
• https://github.com/matrix-org/matrix-appservice-bridge/pull/330 · Note
• https://t.me/cvenotify/16480 · Telegram Post