Vulnerability Details : CVE-2023-38691
matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-38691
- Matrix » Matrix-appservice-bridge » For Node.jsVersions from including (>=) 4.0.0 and before (<) 8.1.2cpe:2.3:a:matrix:matrix-appservice-bridge:*:*:*:*:*:node.js:*:*
- cpe:2.3:a:matrix:matrix-appservice-bridge:9.0.0:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-38691
0.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-38691
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST | |
|
5.0
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
3.1
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2023-38691
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2023-38691
-
https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exchange, allowing unauthorized access to provisioning APIs · Advisory · matrix-org/matrix-appservice-bridge · GitHubThird Party Advisory
-
https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552
Merge pull request from GHSA-vc7j-h8xg-fv5x · matrix-org/matrix-appservice-bridge@4c6723a · GitHubPatch
Jump to