CVE-2023-38690

CVSS V2 None CVSS V3 None
Description
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.
Overview
  • CVE ID
  • CVE-2023-38690
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-08-04T16:31:41.840Z
  • Last Modified Date
  • 2023-08-04T16:31:41.840Z
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CWE-77 http://cwe.mitre.org/data/definitions/77.html
References
Reference URL Reference Tags
https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3 x_refsource_CONFIRM
https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3 x_refsource_MISC
https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-38690
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38690
History
Created Old Value New Value Data Type Notes
2024-06-25 21:26:38 Added to TrackCVE