CVE-2024-39691 — matrix-appservice-irc is a Node

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they&#x

01What is this vulnerability?

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message…

02Affected products

Vendor	Product	Versions
matrix-org	matrix	appservice-irc — < 2.0.1

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

08Timeline

• Published: 2024-07-05T18:42:06.864Z
• Last modified: 2024-08-02T04:26:15.991Z

09References

• github.com — https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-w9m…
• github.com — https://github.com/matrix-org/matrix-appservice-irc/pull/1804
• github.com — https://github.com/matrix-org/matrix-appservice-irc/commit/1835e047f269001054be4…
• github.com — https://github.com/matrix-org/matrix-appservice-irc/blob/d5d67d1d3ea3f0f6962a0af…