CVE-2023-38700: matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
Impact
It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target.
Patches
Please upgrade to 1.0.1.
Workarounds
You can set the matrixHandler.eventCacheSize config value to 0 to workaround this bug. However, this may impact performance.
Credits
Discovered and reported by Val Lorentz.
For more information
If you have any questions or comments about this advisory email us at security@matrix.org.
Other sources
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the matrixHandler.eventCacheSize config value to 0. This workaround may impact performance.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-38700?
CVE-2023-38700 is a vulnerability in the matrix-appservice-irc Node.js IRC bridge for Matrix.
What is the impact of CVE-2023-38700?
The impact of CVE-2023-38700 is that it allows an attacker to leak part of a targeted message event from another bridged room.
How can I fix CVE-2023-38700?
To fix CVE-2023-38700, please upgrade to version 1.0.1 of matrix-appservice-irc.
Are there any workarounds for CVE-2023-38700?
Yes, you can set the `matrixHandler.eventCacheSize` config value to `0` as a workaround for CVE-2023-38700.
What is the severity of CVE-2023-38700?
CVE-2023-38700 has a severity level of low.