PT-2022-24802 · Dendrite · Dendrite

Neilalexander + 1 · Published 2022-09-12 · Updated 2024-08-21 · CVE-2022-39200

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dendrite versions prior to 0.9.8

Description The issue concerns events retrieved from a remote homeserver using the "/get missing events" path, where signatures were not verified correctly. This could allow a remote homeserver to provide invalid or modified events to Dendrite via this endpoint. Events retrieved through other endpoints, such as "/event" and "/state", have been correctly verified. Homeservers with federation disabled are not vulnerable.

Recommendations For Dendrite versions prior to 0.9.8, upgrade to Dendrite 0.9.8 to resolve the issue. As a temporary workaround, consider disabling federation to minimize the risk of exploitation. Note that there are no other known workarounds for this issue.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2022-39200

GHSA-PFW4-XJGM-267C

GO-2022-0989

Affected Products

Dendrite

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39200.json · Exploit
• https://github.com/matrix-org/dendrite/commit/2792d0490f3771488bad346981b8c26479a872c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39200 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39200 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pfw4-xjgm-267c · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0989 · Vendor Advisory
• https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c · Note
• https://github.com/matrix-org/dendrite · Note
• https://t.me/cvenotify/36252 · Telegram Post
• https://t.me/cibsecurity/49605 · Telegram Post