5 ms·

Critical vulnerability in the Matrix IRC bridge

99 points by erk__ 4y ago

charcircuit 4y ago
>The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. How can a matrix user execute commands when they are my definition not in the IRC server? Does it mean it allows the bot to execute commands?
- q3k 4y ago
  Every (active) Matrix user in a bridged room (or portal) has a corresponsing user/connection on IRC. That is, if you join a bridged Matrix room as @charcircuit:example.com, the appservice responsible for bridging said room to IRC will open a connection with NICK/USER charcircuit to IRC (if not open already). Effectively, appservice-irc is a multi tenant IRC client.
Reventlov 4y ago
How much did Element pay the researcher for this find ? Element has a bug bounty program, no ?
- jeroenhd 4y ago
  I don't see a reference to this issue on their bug bounty page (https://app.intigriti.com/programs/matrix/matrix/detail https://app.intigriti.com/programs/matrix/matrix/detail) but it's possible that the researcher came to them directly or didn't want a reward. You'll have to ask the person who demonstrated the vulnerability. According to their responsible disclosure page (https://matrix.org/security-disclosure-policy/ https://matrix.org/security-disclosure-policy/) they don't generally do bug bounties. I'm not sure what their intigrity page is all about, perhaps they did in the past?
- vrfvr 4y ago
  Researcher? A click on the url to his homepage reveals that he is a backend software engineer who does volunteer work on free software and open protocols
  - lucideer 4y ago
    What do you think a researcher is in this context?
    - deleted 4y ago
      [deleted]
    - AyyWS 4y ago
      Needs a white lab coat.
    - vrfvr 4y ago
      A person who's job it is to do research on security of software
      - lucideer 4y ago
        So pay is a prerequisite and not skillset? Surely that would just be a "professional researcher", no? And even so, does a freelance researcher "have a job", in the traditional sense?
      - cjbprime 4y ago
        In the infosec community, "researcher" is the noun of choice to describe anyone who has discovered a security vulnerability, no matter their motivation or experience.
    - stjohnswarts 4y ago
      Gotta be a PhD computer scientist in security at MIT else you're a poseur I guess? :)
  - deleted 4y ago
    [deleted]
- Arathorn 4y ago
  Element currently piggybacks on the Matrix.org Foundation bug bounty programmes (which are the relevant ones here anyway, given matrix-appservice-irc is a Matrix.org project - i.e. owned by and managed by the Foundation, albeit with lots of contributions from Element employees) Right now the Matrix.org Foundation is between bug bounties - we ran an EU funded one via Intigriti last year (https://portswigger.net/daily-swig/intigriti-launches-eu-backed-bug-bounty-program-for-matrix-secure-communications-tool https://portswigger.net/daily-swig/intigriti-launches-eu-bac...) until the funding was consumed, and I'm literally about to sign the contract on a new permanent one for the Matrix Foundation funded by Element run by YesWeHack. EDIT: https://matrix.org/security-disclosure-policy/ https://matrix.org/security-disclosure-policy/ will get updated when the new bounty programme is live. You can see the history of that page over at https://github.com/matrix-org/matrix.org/commits/master/gatsby/src/pages/security-disclosure-policy.js https://github.com/matrix-org/matrix.org/commits/master/gats... in terms of when bounties have come & gone over the years.
  - Reventlov 4y ago
    Ok, thanks for the info (so, 0$).
deleted 4y ago
[deleted]
rdl 4y ago
Is there a decent overview of commercial adoption of Matrix? i.e. what are the top 10 biggest companies using Matrix, and is there a vehicle by which they could pay for some security audits and bug bounties above and beyond the Matrix foundation?

99 points by erk__ 4y ago

>The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. How can a matrix user execute commands when they are my definition not in the IRC server? Does it mean it allows the bot to execute commands?

q3k 4y ago
Every (active) Matrix user in a bridged room (or portal) has a corresponsing user/connection on IRC. That is, if you join a bridged Matrix room as @charcircuit:example.com, the appservice responsible for bridging said room to IRC will open a connection with NICK/USER charcircuit to IRC (if not open already). Effectively, appservice-irc is a multi tenant IRC client.

Reventlov 4y ago

How much did Element pay the researcher for this find ? Element has a bug bounty program, no ?

jeroenhd 4y ago
I don't see a reference to this issue on their bug bounty page (https://app.intigriti.com/programs/matrix/matrix/detail https://app.intigriti.com/programs/matrix/matrix/detail) but it's possible that the researcher came to them directly or didn't want a reward. You'll have to ask the person who demonstrated the vulnerability. According to their responsible disclosure page (https://matrix.org/security-disclosure-policy/ https://matrix.org/security-disclosure-policy/) they don't generally do bug bounties. I'm not sure what their intigrity page is all about, perhaps they did in the past?
vrfvr 4y ago
Researcher? A click on the url to his homepage reveals that he is a backend software engineer who does volunteer work on free software and open protocols
- lucideer 4y ago
  What do you think a researcher is in this context?
  - deleted 4y ago
    [deleted]
  - AyyWS 4y ago
    Needs a white lab coat.
  - vrfvr 4y ago
    A person who's job it is to do research on security of software
    - lucideer 4y ago
      So pay is a prerequisite and not skillset? Surely that would just be a "professional researcher", no? And even so, does a freelance researcher "have a job", in the traditional sense?
    - cjbprime 4y ago
      In the infosec community, "researcher" is the noun of choice to describe anyone who has discovered a security vulnerability, no matter their motivation or experience.
  - stjohnswarts 4y ago
    Gotta be a PhD computer scientist in security at MIT else you're a poseur I guess? :)
- deleted 4y ago
  [deleted]
Arathorn 4y ago
Element currently piggybacks on the Matrix.org Foundation bug bounty programmes (which are the relevant ones here anyway, given matrix-appservice-irc is a Matrix.org project - i.e. owned by and managed by the Foundation, albeit with lots of contributions from Element employees) Right now the Matrix.org Foundation is between bug bounties - we ran an EU funded one via Intigriti last year (https://portswigger.net/daily-swig/intigriti-launches-eu-backed-bug-bounty-program-for-matrix-secure-communications-tool https://portswigger.net/daily-swig/intigriti-launches-eu-bac...) until the funding was consumed, and I'm literally about to sign the contract on a new permanent one for the Matrix Foundation funded by Element run by YesWeHack. EDIT: https://matrix.org/security-disclosure-policy/ https://matrix.org/security-disclosure-policy/ will get updated when the new bounty programme is live. You can see the history of that page over at https://github.com/matrix-org/matrix.org/commits/master/gatsby/src/pages/security-disclosure-policy.js https://github.com/matrix-org/matrix.org/commits/master/gats... in terms of when bounties have come & gone over the years.
- Reventlov 4y ago
  Ok, thanks for the info (so, 0$).

deleted 4y ago

[deleted]

rdl 4y ago

Is there a decent overview of commercial adoption of Matrix? i.e. what are the top 10 biggest companies using Matrix, and is there a vehicle by which they could pay for some security audits and bug bounties above and beyond the Matrix foundation?