CVE-2022-39203: Parsing issue in matrix-org/node-irc leading to room takeovers
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via dynamicChannels.enabled to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-39203?
CVE-2022-39203 is a vulnerability in matrix-appservice-irc where attackers can combine an attacker-owned channel and an existing channel, granting themselves permissions in the channel.
What is the severity of CVE-2022-39203?
CVE-2022-39203 has a severity rating of high (8.8).
How does CVE-2022-39203 affect Matrix Matrix Irc Bridge?
CVE-2022-39203 affects Matrix Matrix Irc Bridge version up to and exclusive of 0.35.0.
How can an attacker exploit CVE-2022-39203?
An attacker can exploit CVE-2022-39203 by specifying a specific string of characters that confuses the bridge and allows them to grant themselves permissions in a channel.
Is there a fix for CVE-2022-39203?
Yes, a fix for CVE-2022-39203 is available in version 0.35.0 of matrix-appservice-irc.