CVE-2023-38691
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
Impact
### Impact A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. ### Details The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. ### Workarounds Disable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | matrix-appservice-bridge | >= 4.0.0, < 8.1.2 | 8.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Matrix | Matrix-Appservice-Bridge | from 4.0.0 before 8.1.2 Version 9.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552
- https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x
- https://github.com/advisories/GHSA-vc7j-h8xg-fv5x
- https://nvd.nist.gov/vuln/detail/CVE-2023-38691