PT-2022-24844 · Unknown+10 · Matrix Javascript Sdk+10
Benjamin Dowling
+3
·
Published
2022-09-28
·
Updated
2025-09-29
·
CVE-2022-39251
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Matrix Javascript SDK versions prior to 19.7.0
Description
The issue allows an attacker cooperating with a malicious homeserver to construct messages that appear to come from another person without indication. A sophisticated attacker could employ this vulnerability to perform a targeted attack, sending fake to-device messages appearing to originate from another user. This can allow injecting the key backup secret during self-verification, making a targeted device use a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. The attack requires coordination between a malicious homeserver and an attacker.
Recommendations
For versions prior to 19.7.0, update to version 19.7.0 or later, which only accepts Olm-encrypted to-device messages and includes additional checks for security. As a precaution, avoid using emoji/QR verification methods for new logins until patched, and instead, verify with your security passphrase. If you trust your homeserver, no particular workaround is needed.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Matrix Javascript Sdk
Red Hat
Rocky Linux
Suse
Ubuntu