PT-2024-28630 · Unknown · Matrix-Appservice-Irc

Progval · Published 2024-07-05 · Updated 2024-07-08 · CVE-2024-39691

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions matrix-appservice-irc versions prior to 2.0.1

Description The issue arises from the reliance on the Matrix homeserver-provided timestamp to determine user access to events. A malicious Matrix homeserver can fabricate this timestamp to trick the bridge into leaking room messages it should not have access to. The bridge tracks event timestamps internally in version 2.0.1, dropping the reliance on origin server ts. As a workaround, limiting the amount of information leaked is possible by setting a reply template that doesn't contain the original message.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider setting a reply template that doesn't contain the original message to limit the amount of information leaked.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-280

Related Identifiers

CVE-2024-39691

GHSA-W9MH-5X8J-9754

Affected Products

Matrix-Appservice-Irc

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39691.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-39691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39691 · Security Note
• https://osv.dev/vulnerability/GHSA-w9mh-5x8j-9754 · Vendor Advisory
• https://github.com/matrix-org/matrix-appservice-irc · Note
• https://github.com/matrix-org/matrix-appservice-irc/commit/1835e047f269001054be4c68867797aa12372a0f · Note
• https://github.com/matrix-org/matrix-appservice-irc/pull/1804 · Note
• https://github.com/matrix-org/matrix-appservice-irc/blob/d5d67d1d3ea3f0f6962a0af2cc57b56af3ad2129/config.sample.yaml#L601-L604 · Note
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-w9mh-5x8j-9754 · Note
• https://t.me/cvedetector/128 · Telegram Post
• https://t.me/cvenotify/85285 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1809330237240492388 · Twitter Post
• https://twitter.com/CVEnew/status/1809298979676639233 · Twitter Post