CVE-2023-38700 matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms

What is CVE-2023-38700?

CVE-2023-38700 is a low-severity vulnerability in matrix-org matrix-appservice-irc, published on 4 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance.

Weakness: CWE-200

Which versions are affected by CVE-2023-38700?

2 open source packages ship an affected version, including matrix-appservice-irc. It affects 1 product.

Products include Matrix Matrix Irc Bridge.

How do I fix CVE-2023-38700?

Upgrade matrix-appservice-irc to 1.0.1 or later.

Is CVE-2023-38700 being exploited?

There is no known exploitation of CVE-2023-38700 in the wild and no public exploit code.

Other vulnerabilities in matrix-org matrix-appservice-irc

• CVE-2022-39203 Parsing issue in matrix-org/node-irc leading to room takeovers High 8.8
• CVE-2022-29166 Improper handling of multiline messages in matrix-appservice-irc High 8.0
• CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines Medium 5.8
• CVE-2022-3971 matrix-appservice-irc PgDataStore.ts sql injection Medium 4.6
• CVE-2022-39202 IRC mode parameter confusion in matrix-appservice-irc Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c7hh-3v6c-fj4q.