PT-2022-24840 · Unknown · Matrix-Android-Sdk

Benjamin Dowling + 3 · Published 2022-09-28 · Updated 2022-09-30 · CVE-2022-39248

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions matrix-android-sdk2 versions prior to 1.5.1

Description An attacker cooperating with a malicious homeserver can construct messages that appear to have come from another person without any indication. This vulnerability can be used to perform targeted attacks, sending fake to-device messages and potentially injecting key backup secrets. The issue is due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.

Recommendations For versions prior to 1.5.1, update to version 1.5.1, which only accepts Olm-encrypted to-device messages and stops signing backups on successful decryption. As a temporary workaround, consider avoiding the use of emoji/QR verification methods for new logins until the update is applied, and instead use verify with passphrase. Restrict access to untrusted devices and discard secrets received from them. Ensure key backups are only usable if they have a valid signature from a trusted device.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-322

Related Identifiers

CVE-2022-39248

GHSA-FPGF-PJJV-2QGM

Affected Products

Matrix-Android-Sdk

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39248.json · Exploit
• https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e · Patch
• https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-fpgf-pjjv-2qgm · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39248 · Security Note
• https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39248 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpgf-pjjv-2qgm · Vendor Advisory
• https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1 · Note
• https://github.com/matrix-org/matrix-android-sdk2 · Note
• https://t.me/cibsecurity/50640 · Telegram Post
• https://t.me/true_secator/3497 · Telegram Post