Background

The IRC protocol is based on lines, delimited by <CRLF> (aka \r\n). For example, sending two messages to users A and B looks like this:

  PRIVMSG B :second message
]]>

When sending messages from Matrix IRC, matrix-appservice-irc correctly sanitizes \n away, by re-adding the right prefixes to each message. For example, the Matrix message

  {
    "msgtype": "m.text",
    "first line\nsecond line"
  }

  PRIVMSG #chan :second line
]]>

However, some IRC servers also support <CR> alone as delimiter (see the Modern-IRC specification). For example, this includes Solanum, the IRC server used by Libera.chat.

First issue: missing sanitization

matrix-appservice-irc did not sanitize <CR>, which means the Matrix message

  PRIVMSG #chan :second line
]]>

This alone is only a minor issue, as someone sending the payload is the "owner" of the IRC puppet.

Second issue: repeated reply fallback

However, under certain circumstances, matrix-appservice-irc repeats the original message (ie. the reply fallback) when sending a reply. This means that if an attacker sends the above Matrix and tricks a victim into replying to it with "answer", the Matrix event of the answer is something like this:

 <@attacker:matrix.org> first line\rsecond line\nanswer",
    "format": "org.matrix.custom.html",
    "formatted_body": "
In reply to @attacker:matrix.org
first line\rsecond lineanswer",
    "m.relates_to": {
      "m.in_reply_to": {
        "event_id": "redacted"
      }
    },
    "msgtype": "m.text",
    ...
  }
]]>

  second line
  PRIVMSG #chan :answer
]]>

Wrapping-up

This second line is under the attacker's control, so they can run any command as the victim's puppet. For example, it could be QUIT :bye to make them disconnect, or PRIVMSG NickServ :SET PASSWORD hunter2 to change the password of the victim's account on the IRC network.

The obvious limitations to this attack is that victims would see the message they are replying to; but this might be hidden by attackers by adding colors, surrounding text, or simply the victim being unaware of the issue.

Conclusion

On 2022-05-04, Matrix.org published a fix to the first issue (missing sanitization), fixing this vulnerability. The second issue (attacker-controlled text being repeated when replying) is being tracked independently as a "Tolerable" issue and not fixed at this time; though planned changes to the Matrix specification will make it a non-issue eventually.