CVE-2022-39202: IRC mode parameter confusion in matrix-appservice-irc
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39202?
CVE-2022-39202 refers to a vulnerability in matrix-appservice-irc, an open source Node.js IRC bridge for Matrix, which allows an attacker to execute arbitrary code by sending specially crafted IRC messages.
How does CVE-2022-39202 impact the affected software?
CVE-2022-39202 can lead to remote code execution in versions of matrix-appservice-irc up to and including 0.35.0.
What is the severity of CVE-2022-39202?
CVE-2022-39202 has a severity score of 6.3 out of 10, indicating a medium severity.
How can I fix CVE-2022-39202?
To fix CVE-2022-39202, it is recommended to upgrade to matrix-appservice-irc version 0.36.0 or later, which includes a patch for the vulnerability.
Are there any additional references for CVE-2022-39202?
Yes, you can find additional information and resources on CVE-2022-39202 in the following links: [GitHub Commit](https://github.com/matrix-org/matrix-appservice-irc/commit/5f87dbed87b4b6dc49b7965ff152ee8535719e67), [GitHub Security Advisory](https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-cq7q-5c67-w39w), [Matrix Blog Post](https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/).