Jadedblueeyes

**Name of the Vulnerable Software and Affected Versions** Continuwuity versions prior to 0.5.1 Conduit versions prior to 0.10.11 Grapevine versions prior to 0aae932b Tuwunel versions prior to 1.4.9 **Description** A flaw exists that allows a malicious remote server to cause a local server to sign an arbitrary event upon user interaction. This occurs when a user account leaves a room, joins a room, or knocks on a room, potentially prompting the victim server to request assistance from a remote server. If the victim requests assistance from an attacker-controlled server, the attacker can provide an arbitrary event, which the victim server will then sign and return. The `/leave` endpoint is vulnerable to any event with a supported room version, requiring the origin and origin server ts to be set by the victim. The `/join` endpoint requires an additional victim-set content field in the format of a join membership. The `/knock` endpoint requires an additional victim-set content field in the format of a knock membership and a room version not between 1 and 6. This issue was exploited against the continuwuity.org homeserver. **Recommendations** Update Continuwuity to version 0.5.1 or later. Update Conduit to version 0.10.11 or later. Update Grapevine to version 0aae932b or later. Update Tuwunel to version 1.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** continuwuity versions prior to 0.5.0 **Description** A remote, unauthenticated attacker can force the target server to cryptographically sign arbitrary membership events. This occurs because the server does not validate the origin of a signing request when the event's state key is a valid user ID belonging to the target server. The vulnerable API endpoint is `/ matrix/federation/v2/invite/{roomId}/{eventId}`. **Recommendations** Block access to the PUT `/ matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using a reverse proxy. Update to version 0.5.0 or later.