PT-2022-24841 · Unknown+10 · Matrix Javascript Sdk+10
Benjamin Dowling
+3
·
Published
2022-09-28
·
Updated
2025-09-29
·
CVE-2022-39249
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Matrix Javascript SDK versions prior to 19.7.0
Description
An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. The SDK now sets a
trusted flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with trusted = false are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust their homeservers do not need a workaround.Recommendations
Update to version 19.7.0 or later, which includes a more strict default policy for accepting key forwards.
As a temporary workaround, consider decorating messages decrypted with a key with
trusted = false appropriately, for example, by showing a warning for such messages.
Restrict access to the key forwarding mechanism to minimize the risk of exploitation.
Ensure that clients handle messages with trusted = false correctly, for example, by showing a warning for such messages.Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Matrix Javascript Sdk
Red Hat
Rocky Linux
Suse
Ubuntu