PT-2023-28902 · Github+2 · Github+2

Half-Shot · Published 2023-09-27 · Updated 2023-10-05 · CVE-2023-43656

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions matrix-hookshot versions prior to 4.5.0

Description The issue affects matrix-hookshot, a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances with enabled transformation functions, specifically those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of the vm2 sandbox. This problem is more likely to affect users who have allowed untrusted users to apply their own transformation functions. The threat is reduced, though not eliminated, for users who have only enabled a limited set of trusted users.

Recommendations For versions prior to 4.5.0, upgrade to version 4.5.0 or above, which includes a new sandbox library for better protection. For users unable to upgrade, disable generic.allowJsTransformationFunctions in the config as a temporary workaround.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-43656

GHSA-FR97-PV6W-4CJ6

Affected Products

Github

Gitlab

Jira

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43656.json · Exploit
• https://github.com/matrix-org/matrix-hookshot/commit/dc126afa6af86d66aefcd23a825326f405bcc894 · Patch
• https://github.com/matrix-org/matrix-hookshot/security/advisories/GHSA-fr97-pv6w-4cj6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43656 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43656 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1707165403003166889 · Twitter Post
• https://twitter.com/CVEnew/status/1707144350596260091 · Twitter Post
• https://t.me/cvenotify/59040 · Telegram Post
• https://twitter.com/IT_securitynews/status/1708414805306974646 · Twitter Post
• https://t.me/cibsecurity/71155 · Telegram Post