Veracode Vulnerability DatabaseVERACODE:42644Arbitrary Command Injection
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
52.7%
matrix-appservice-irc is vulnerable to Arbitrary Command Injection. The vulnerability exists due to improper handling of commands with newlines (\n) which allows an attacker to inject and execute arbitrary commands on the IRC bridge bot.
References
github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3
github.com/matrix-org/matrix-appservice-irc/commit/11f0d073949bc794105e97eb4ccaf4b801af8bd8
github.com/matrix-org/matrix-appservice-irc/commit/c557cbe011a81a930e0c2cba599ebca021a7cab8
github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1
github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
52.7%