Vulnerability · Published May 5, 2022 · Assigned by GitHub_M

CVE-2022-29166Improper handling of multiline messages in matrix-appservice-irc

High 8.0

In plain English

A high-severity injection in matrix-appservice-irc from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)1.0%top 36.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	matrix-appservice-irc	0.33.2	GHSA-37hr-348p-rmf4

Affected products (as reported)

Vendor	Product	Versions
matrix-org	matrix-appservice-irc	< 0.34.0

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4 x_refsource_CONFIRM
https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity x_refsource_MISC