PT-2022-23108 · Unknown+1 · Gomatrixserverlib+1

Moderateneilalexander · Published 2022-08-19 · Updated 2022-08-30 · CVE-2022-36009

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dendrite versions prior to 0.9.3 gomatrixserverlib versions prior to commit 723fd49

Description The power level parsing within gomatrixserverlib was failing to parse the "events default" key of the m.room.power levels event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the "events default" power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers.

Recommendations For Dendrite versions prior to 0.9.3, upgrade to Dendrite 0.9.3 or later. For gomatrixserverlib versions prior to commit 723fd49, update gomatrixserverlib to a version that includes the fix, at least commit 723fd49. As a temporary workaround, consider avoiding changes to the "events default" power level in matrix rooms until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-36009

GHSA-GRVV-H2F9-7V9C

GO-2022-0952

Affected Products

Dendrite

Gomatrixserverlib

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36009.json · Exploit
• https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575 · Patch
• https://osv.dev/vulnerability/GO-2022-0952 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-grvv-h2f9-7v9c · Vendor Advisory
• https://matrix.org/docs/guides/moderation/#power-levels · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36009 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36009 · Vendor Advisory
• https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c · Note
• https://github.com/matrix-org/gomatrixserverlib · Note
• https://pkg.go.dev/vuln/GO-2022-0952 · Note
• https://t.me/cvenotify/35109 · Telegram Post
• https://t.me/cvenotify/34999 · Telegram Post
• https://t.me/cibsecurity/48463 · Telegram Post