CVE-2025-23197 Overview
CVE-2025-23197 is a Denial of Service (DoS) vulnerability in matrix-hookshot, a Matrix bot that bridges rooms to external services like GitHub, GitLab, and JIRA. The flaw affects Hookshot 6 versions 6.0.1 and earlier, and Hookshot 5 versions 5.4.1 and earlier, when configured with GitHub support. A missing check on GitHub App installations causes Hookshot to crash on restart. Deployments that permit untrusted users to add their own GitHub organizations are at elevated risk, since any such installation entering a suspended state can trigger the crash. The issue is fixed in versions 6.0.2 and 5.4.2 and is categorized under [CWE-754] (Improper Check for Unusual or Exceptional Conditions).
Critical Impact
An authenticated but low-privileged actor can crash the Hookshot service on restart, disrupting all Matrix room bridges to external services.
Affected Products
- matrix-hookshot 6.x versions 6.0.1 and earlier
- matrix-hookshot 5.x versions 5.4.1 and earlier
- Hookshot deployments configured with GitHub support
Discovery Timeline
- 2025-01-27 - CVE-2025-23197 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23197
Vulnerability Analysis
The vulnerability resides in src/github/GithubInstance.ts, which enumerates GitHub App installations during startup. Hookshot iterates the list returned by internalOctokit.apps.listInstallations and calls addInstallation on every entry. The code does not check whether an installation has been suspended, and it does not wrap the call in error handling. When addInstallation throws for a suspended install, the exception propagates and terminates the service during restart.
An attacker who can add a GitHub organization to Hookshot can influence this list. Suspending or otherwise breaking the app installation server-side causes the bot to fail the next restart, producing a persistent outage until an administrator intervenes.
Root Cause
The root cause is an improper check for an exceptional condition [CWE-754]. Hookshot assumed that every installation returned by the GitHub API was in a usable state and did not validate the suspended_at field before attempting to register it. Combined with the absence of a try/catch around addInstallation, a single failing install aborted initialization of all bridges.
Attack Vector
Exploitation requires network access to the Hookshot instance and the ability to add a GitHub organization, which corresponds to low-privilege authenticated access. No user interaction is required. Impact is limited to availability; confidentiality and integrity are not affected. The vulnerability becomes exploitable when the service restarts, so any operation that forces a restart (scheduled maintenance, deploys, crash recovery) will trigger the DoS.
do {
const installations = await this.internalOctokit.apps.listInstallations({ per_page: 100, page: page++ });
for (const install of installations.data) {
- await this.addInstallation(install);
+ if (install.suspended_at) {
+ log.warn(`GitHub app install ${install.id} was suspended. GitHub connections using this install may not work correctly`);
+ continue;
+ }
+ try {
+ await this.addInstallation(install);
+ } catch (ex) {
+ log.info(`Failed to handle GitHub installation ${install.id}`, ex);
+ }
}
installPageSize = installations.data.length;
} while(installPageSize === 100)
// Source: https://github.com/matrix-org/matrix-hookshot/commit/e51d8210233ac759e7f7dfebc2c4f1bf6ce94802
The patch adds a suspended_at check that skips suspended installs and wraps addInstallation in a try/catch so a single failure no longer aborts startup.
Detection Methods for CVE-2025-23197
Indicators of Compromise
- Repeated Hookshot process crashes or restart loops shortly after startup.
- Unhandled promise rejection or exception traces originating in GithubInstance.ts and addInstallation.
- GitHub App installations listed against the Hookshot bot that are in a suspended state.
- New GitHub organizations added to Hookshot by unexpected or untrusted Matrix users prior to the crash.
Detection Strategies
- Monitor Hookshot service logs for exceptions thrown during installation enumeration and correlate with restart events.
- Track process supervisor (systemd, Docker, Kubernetes) restart counts for the Hookshot container or unit.
- Audit Matrix room events for add organization or connection creation actions from non-administrator users.
Monitoring Recommendations
- Alert on Hookshot exit codes and restart frequency exceeding a baseline threshold.
- Query the GitHub API periodically for the state of installations linked to the Hookshot App and flag any suspended_at value.
- Centralize Hookshot logs in a SIEM and build an identification rule for the addInstallation stack trace pattern.
How to Mitigate CVE-2025-23197
Immediate Actions Required
- Upgrade matrix-hookshot to version 6.0.2 (for the 6.x branch) or 5.4.2 (for the 5.x branch).
- Review the current list of GitHub App installations bound to the Hookshot bot and remove or reinstate any that are suspended.
- Restrict who can add GitHub organizations to Hookshot until the upgrade is complete.
Patch Information
The fix is delivered in matrix-hookshot 6.0.2 and 5.4.2. It adds a suspended_at guard and wraps addInstallation in a try/catch block so exceptional installations no longer prevent startup. See the GitHub Security Advisory GHSA-cr4q-jf47-3645 and the upstream commit for the exact change.
Workarounds
- Disable the GitHub bridge configuration in config.yml until the patched version is deployed.
- Configure Hookshot to permit only trusted administrators to add GitHub organizations, limiting who can influence the installations list.
- Manually unsuspend or uninstall any GitHub App installations that cause the restart failure before bringing the service back online.
# Upgrade using npm
npm install matrix-hookshot@6.0.2
# Or pull the patched container image
docker pull matrixdotorg/hookshot:6.0.2
# Verify the running version
hookshot --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
