News for hackers. Stuff that matters.

A comment on Shutting down the Matrix bridge to Libera chat. Parent comment

Re:Shutting down the Matrix bridge to Libera chat by susam on Tuesday November 28, 2023 @05:39PM (#38452465)
I wrote my own IRC + Matrix client to bridge the channels I operate. I've made the source code available under the terms of the MIT license here: https://github.com/susam/nimb

If you find any issues, bugs, etc. in this tool, please let me know. Although this tool works well for my modest requirements, someone else may find issues while using this tool that I have not encountered yet. In such a case, bug reports, pull requests, patches, etc. are very welcome!

[ Parent | on HN ]
Re:Shutting down the Matrix bridge to Libera chat by progval on Tuesday November 28, 2023 @05:47PM (#38452578)
You need to split on (or sanitize) null bytes here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b... and sanitize NUL/CR/LF from the prefix (well, display_name) here: https://github.com/susam/nimb/blob/b40d87ddf2e1134fed4d7380b...

Otherwise you may have a command injection vulnerability similar to what matrix-appservice-irc used to have: https://pktz.fr/matrix/security/2022-appservice-irc-command-... (though with carriage returns instead of null bytes)

[ Parent | on HN ]
Re:Shutting down the Matrix bridge to Libera chat by susam on Tuesday November 28, 2023 @05:54PM (#38452668)
Thank you for taking a close look at the source code and highlighting this issue.

> You need to split on (or sanitize) null bytes

Do you mean splitting on (or sanitising of) carriage returns (CR or 0xD) and newlines (LF or 0xA)? I read your security advisory and as far as I understand, the issue occurs due to improper handling of CR and LF characters. I don't see anything about null bytes there.

[ Parent | on HN ]
Re:Shutting down the Matrix bridge to Libera chat by progval on Tuesday November 28, 2023 @05:57PM (#38452725)
Null bytes are not allowed in IRC messages: https://modern.ircdocs.horse/#parameters

Some IRC servers (especially those written in C) may interpret it as a line end, so you would have a similar issue

[ Parent | on HN ]
Re:Shutting down the Matrix bridge to Libera chat by susam on Tuesday November 28, 2023 @06:50PM (#38453356)
Your security advisory has been quite helpful and I could reproduce the issue involving CR. It is particularly enlightening to know that the null byte could also cause the same issue because some IRC servers may interpret the null byte too as a line ending.

It is late here but I have pushed a quick fix to plug this loophole: <https://github.com/susam/nimb/commit/1c02137>. Review comments, feedback, pull requests, patches, etc. are very welcome! Thank you for this comment thread which has been constructive as well as productive.

[ Parent | on HN ]