CVE-2023-38690
MediumCVSS 5.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In versions prior to 1.0.1 of matrix-appservice-irc, an IRC bridge for Matrix, it is possible to craft a command with newlines that would not be properly parsed. This allows passing a string of commands as a channel name, which could then be executed by the IRC bridge bot.
Risk Assessment
The organization may be exposed to unauthorized command execution by the bot, potentially leading to serious security breaches and loss of control over the system.
Recommendation
It is recommended to upgrade to version 1.0.1 or later to mitigate this vulnerability. Alternatively, disabling dynamic channels in the configuration may help minimize the risk.
Original NVD description (English source)
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.