Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2023-38690

High
9.8/10

Summary

matrix-appservice-irc is a Node.js IRC bridge for Matrix. In versions prior to 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published