CVE-2023-38691: matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
First published: Fri Aug 04 2023(Updated: )
### Impact A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. ### Details The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. ### Workarounds Disable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/matrix-appservice-bridge | =9.0.0 | 9.0.1 |
| npm/matrix-appservice-bridge | >=4.0.0<8.1.2 | 8.1.2 |
| Matrix Matrix-appservice-bridge | >=4.0.0<8.1.2 | |
| Matrix Matrix-appservice-bridge | =9.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552
- https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x
- https://nvd.nist.gov/vuln/detail/CVE-2023-38691
- https://github.com/advisories/GHSA-vc7j-h8xg-fv5x (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-38691.
What is the severity of CVE-2023-38691?
The severity of CVE-2023-38691 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2023-38691?
Versions 4.0.0 to 8.1.2 of matrix-appservice-bridge are affected by CVE-2023-38691. Versions 8.1.2 and 9.0.0 are specifically mentioned.
How can a malicious Matrix server exploit CVE-2023-38691?
A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing them to impersonate users.
How can I fix CVE-2023-38691?
Update to version 9.0.1 of matrix-appservice-bridge.
- collector/nvd-latest
- collector/nvd-api
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-vc7j-h8xg-fv5x
- alias/CVE-2023-38691
- collector/nvd-cve
- collector/github-advisory
- agent/references
- agent/type
- agent/softwarecombine
- agent/severity
- agent/title
- agent/remedy
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/matrix
- canonical/matrix matrix-appservice-bridge
- version/matrix matrix-appservice-bridge/4.0.0
- version/matrix matrix-appservice-bridge/9.0.0
- package-manager/npm