PT-2023-26556 · Unknown · Matrix-Appservice-Bridge

Half-Shot · Published 2023-08-04 · Updated 2023-08-11 · CVE-2023-38691

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions matrix-appservice-bridge versions 4.0.0 through 8.1.1 matrix-appservice-bridge versions 9.0.0

Description A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the sub parameter (containing the user's claimed MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a sub parameter according to the user they want to act as and use the resulting token to perform provisioning requests.

Recommendations For matrix-appservice-bridge versions 4.0.0 through 8.1.1, update to version 8.1.2 or later. For matrix-appservice-bridge version 9.0.0, update to version 9.0.1 or later. As a temporary workaround, consider disabling the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-38691

GHSA-VC7J-H8XG-FV5X

Affected Products

Matrix-Appservice-Bridge

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38691.json · Exploit
• https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-38691 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vc7j-h8xg-fv5x · Vendor Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x · Note
• https://github.com/matrix-org/matrix-appservice-bridge · Note
• https://t.me/cvenotify/56317 · Telegram Post
• https://t.me/cibsecurity/67768 · Telegram Post