Improper Handling of Insufficient Permissions or Privileges

Summary

The matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. The matrix-appservice-irc versions prior to 2.0.1 drop the reliance on "origin_server_ts" when determining whether an event should be visible to a user, instead of tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.