#79 finding 1 (HIGH): link probe pins the shared bot into attacker-named rooms; reap only probe-created joins #83

New issue

Closed

opened 2026-07-11 09:08:05 +00:00 by robocub · 1 comment

robocub commented

2026-07-11 09:08:05 +00:00

Collaborator

From the #79 adversarial review. Not yet fixed — a first attempt (leave-on-any-probe-failure) was implemented and backed out after live e2e showed it tears the bot out of rooms with an ACTIVE bridge (all bridges share one appservice MXID), which in prod would break a live static/tenant bridge.

Problem

probe_room_prereqs (crates/matrix-rtc/src/mgmt.rs) must JOIN a room to read its state, and the join happens before the room-authority check. On the open-registration surface, a federated attacker can link any publicly-joinable room they have no power in: the shared bot joins, authority fails, the reply says "Nothing was written" — but the bot stays a permanent member. Repeating with fresh room ids parks the shared federated identity in arbitrary rooms (presence spam, appearance in member lists, appservice-reputation abuse, unbounded joined-room growth on the single mgmt sync).

Correct fix (needs live iteration)

Leave ONLY a membership the probe itself created: read the bot's own membership BEFORE the join; if it was already join (a running static/tenant bridge, or a prior link), never leave. If the probe newly joined and any later probe/authority check fails — or the pending later expires unapproved / is unlinked — leave (best-effort). Fail SAFE toward not-leaving when the pre-check errors, so an active bridge is never torn out. Add an e2e assertion that an authority-failed probe against an UNbridged room leaves the bot, and that a probe against a bridged room does not.

Severity HIGH (DoS/abuse/reputation; not a consent breach). Blocks public announcement.

From the #79 adversarial review. **Not yet fixed** — a first attempt (leave-on-any-probe-failure) was implemented and **backed out** after live e2e showed it tears the bot out of rooms with an ACTIVE bridge (all bridges share one appservice MXID), which in prod would break a live static/tenant bridge. ## Problem `probe_room_prereqs` (crates/matrix-rtc/src/mgmt.rs) must JOIN a room to read its state, and the join happens before the room-authority check. On the open-registration surface, a federated attacker can `link` any publicly-joinable room they have no power in: the shared bot joins, authority fails, the reply says "Nothing was written" — but the bot stays a permanent member. Repeating with fresh room ids parks the shared federated identity in arbitrary rooms (presence spam, appearance in member lists, appservice-reputation abuse, unbounded joined-room growth on the single mgmt sync). ## Correct fix (needs live iteration) Leave ONLY a membership the probe itself created: read the bot's own membership BEFORE the join; if it was already `join` (a running static/tenant bridge, or a prior link), never leave. If the probe newly joined and any later probe/authority check fails — or the pending later expires unapproved / is unlinked — leave (best-effort). Fail SAFE toward not-leaving when the pre-check errors, so an active bridge is never torn out. Add an e2e assertion that an authority-failed probe against an UNbridged room leaves the bot, and that a probe against a bridged room does not. Severity HIGH (DoS/abuse/reputation; not a consent breach). Blocks public announcement.

robocub referenced this issue

2026-07-11 09:08:28 +00:00

Pre-launch adversarial security + abuse review of the open-registration surface (run on Fable) #79

robocub referenced this issue from a commit

2026-07-11 16:19:23 +00:00

fix(mgmt,config): #83/#84/#85 open-registration hardening (core)

robocub referenced this issue from a commit

2026-07-11 16:26:35 +00:00

fix(mgmt,config): #83/#84/#85 open-registration hardening (core)

robocub referenced this issue

2026-07-11 16:51:02 +00:00

#83 residual: reap abandoned-pending link-probe rooms (periodic sweep) #87

robocub referenced this issue

2026-07-11 16:51:02 +00:00

#85 residual: per-sender invite cooldown + idle DM-room TTL leave #89

robocub commented

2026-07-11 16:51:31 +00:00

Author

Collaborator

Core fixed + shipped in v0.3.0-alpha.18 (master 6dca786, deployed to prod 2026-07-11). The link probe now checks the bot's own /joined_rooms before joining and, on any post-join failure, leaves the room only if the probe created the membership — a room with an active bridge is never torn out (the correct form of the alpha.16 revert). Live-verified on staging (mgmt_self_serve_link PASS, 0 tear-outs of the bridged room). Residual (reap abandoned-pending rooms via a periodic sweep) tracked in #87.

Core fixed + shipped in **v0.3.0-alpha.18** (master `6dca786`, deployed to prod 2026-07-11). The `link` probe now checks the bot's own `/joined_rooms` before joining and, on any post-join failure, leaves the room **only if the probe created the membership** — a room with an active bridge is never torn out (the correct form of the alpha.16 revert). Live-verified on staging (`mgmt_self_serve_link` PASS, 0 tear-outs of the bridged room). Residual (reap abandoned-pending rooms via a periodic sweep) tracked in #87.

robocub closed this issue

2026-07-11 16:51:31 +00:00

robocub referenced this issue

2026-07-13 04:26:37 +00:00

mgmt: self-serve link of an invite-only room is unsatisfiable — the invite gate rejects the invite the link reply instructs #111

robocub referenced this issue from a commit

2026-07-13 17:27:34 +00:00

feat(mgmt): awaiting-invite link resume — self-serve link of invite-only rooms (#111)

robocub referenced this issue

2026-07-13 17:27:57 +00:00

feat(mgmt): awaiting-invite link resume — self-serve link of invite-only rooms (#111) #119

robocub referenced this issue