~ / search / GHSA-vc7j-h8xg-fv5x

GHSA-vc7j-h8xg-fv5x

matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-38691

Packages

EcosystemPackageAffectedFixed in
npm matrix-appservice-bridge >= 4.0.0, < 8.1.2 8.1.2
npm matrix-appservice-bridge >= 9.0.0, < 9.0.1 9.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. ### Details The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. ### Workarounds Disable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.

References

External links from the advisory. They lead to third-party sites.