CVE-2022-29166: Improper handling of multiline messages in matrix-appservice-irc
Summary
CVE-2022-29166: Improper handling of multiline messages in node-irc affects matrix-appservice-irc. Affects matrix-appservice-irc versions < 0.33.2. Fixed in 0.33.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-appservice-irc is an IRC bridge for Matrix, providing a means to connect IRC networks and Matrix rooms. It facilitates communication between users on both platforms by bridging messages and commands. This vulnerability in node-irc, a dependency of matrix-appservice-irc, allows an attacker to manipulate a Matrix user into executing IRC commands by tricking them into replying to a specially crafted message. By exploiting this vulnerability, an attacker can potentially gain unauthorized access, perform malicious actions, or extract sensitive information from the affected Matrix user.
Vulnerability Detail
The vulnerability arises from improper handling of multiline messages in node-irc. By sending a multiline message with malicious intent, an attacker can inject IRC commands into the message, which will be executed when the targeted Matrix user replies to it. This can lead to various security risks, including unauthorized actions on IRC networks, disclosure of sensitive information, or even remote code execution. The issue has been addressed in matrix-appservice-irc version 0.33.2.
How To Fix
Minimum fixed version
0.33.2
This is the first release that contains the fix.
npm install matrix-appservice-irc@0.33.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should exercise caution when replying to messages from untrusted participants in IRC-bridged Matrix rooms. It is advisable to refrain from replying to messages that seem suspicious or come from unknown sources. By avoiding interaction with potentially malicious messages, the risk of inadvertently executing IRC commands can be mitigated.
Conclusion
The vulnerability in matrix-appservice-irc, arising from improper handling of multiline messages in node-irc, allows attackers to manipulate Matrix users into executing IRC commands. This can result in unauthorized actions, information disclosure, or even remote code execution. It is crucial to upgrade to matrix-appservice-irc version 0.33.2 or later to address this vulnerability. Exercise caution when replying to messages from untrusted sources as a temporary workaround. For further assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-appservice-irc →
FAQ
matrix-appservice-irc is an IRC bridge for Matrix, enabling communication between IRC networks and Matrix rooms.
node-irc is a dependency of matrix-appservice-irc, responsible for handling IRC functionality.
This vulnerability allows an attacker to manipulate Matrix users into executing IRC commands, potentially leading to unauthorized actions, information disclosure, or remote code execution.
Yes, the vulnerability has been addressed in matrix-appservice-irc version 0.33.2.
It is recommended to upgrade to matrix-appservice-irc version 0.33.2 or later to mitigate the vulnerability. Follow the provided steps in the 'how_to_fix' section for guidance.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-appservice-irc.
