PT-2022-24803 · Node-Irc+1 · Node-Irc+1

Val Lorentz · Published 2022-09-13 · Updated 2022-09-16 · CVE-2022-39202

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions matrix-appservice-irc versions prior to 0.35.0

Description The issue arises from a bug in the underlying matrix-org/node-irc library, causing matrix-appservice-irc to incorrectly parse multiple modes in a single mode command. This can potentially result in the wrong user being given permissions. Mode commands can only be executed by privileged users, so exploitation requires an operator to be tricked into running the command on behalf of an attacker.

Recommendations For versions prior to 0.35.0, update to version 0.35.0 to resolve the issue. As a temporary workaround, refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command until the issue is resolved.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-39202

GHSA-CQ7Q-5C67-W39W

Affected Products

Matrix-Appservice-Irc

Node-Irc

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39202.json · Exploit
• https://github.com/matrix-org/matrix-appservice-irc/commit/5f87dbed87b4b6dc49b7965ff152ee8535719e67 · Patch
• https://osv.dev/vulnerability/CVE-2022-39202 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cq7q-5c67-w39w · Vendor Advisory
• https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39202 · Security Note
• https://github.com/matrix-org/matrix-appservice-irc · Note
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-cq7q-5c67-w39w · Note
• https://t.me/cibsecurity/49706 · Telegram Post