GHSA-52rh-5rpj-c3w6: Improper handling of multiline messages in node-irc
(updated )
node-irc is a socket wrapper for the IRC protocol that extends Node.js’ EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel. The vulnerability has been patched in node-irc version 1.2.1.
References
- github.com/advisories/GHSA-52rh-5rpj-c3w6
- github.com/matrix-org/node-irc
- github.com/matrix-org/node-irc/commit/2976c856df37660a9d664e94c857c796de2e34f7
- github.com/matrix-org/node-irc/commit/e3eb9c15f8240e9c92365f5ffc3944469229771b
- github.com/matrix-org/node-irc/security/advisories/GHSA-52rh-5rpj-c3w6
- matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity
- nvd.nist.gov/vuln/detail/CVE-2022-29166
Code Behaviors & Features
Detect and mitigate GHSA-52rh-5rpj-c3w6 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →