Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2023-38691
Good to know:
Date: August 4, 2023
matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the "sub" parameter (containing the user's claimed MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a "sub" parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API.
Language: TYPE_SCRIPT
Severity Score
Related Resources (5)
Severity Score
Weakness Type (CWE)
Improper Authentication
CWE-287Top Fix
Upgrade Version
Upgrade to version matrix-appservice-bridge - 8.1.2;matrix-appservice-bridge - 9.0.1
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | NONE |
| Scope (S): | CHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | NONE |
| Availability (A): | NONE |