PT-2022-24845 · Unknown · Matrix-Rust-Sdk

Lowpoljar · Published 2022-09-29 · Updated 2022-10-03 · CVE-2022-39252

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions matrix-rust-sdk versions prior to 0.6

Description The issue arises when a user requests a room key from their devices. The software correctly remembers the request but fails to check the origin of the forwarded room key, allowing homeservers to potentially insert room keys of questionable validity. This could facilitate an impersonation attack. It's noted that even if key injection succeeds, all forwarded keys have the imported flag set, indicating lesser authentication properties.

Recommendations For versions prior to 0.6, update to version 0.6 to resolve the issue. As a temporary workaround, consider restricting the acceptance of forwarded room keys to only those that are responses to previous requests and come from the expected device.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-322

Related Identifiers

CVE-2022-39252

GHSA-VP68-2WRM-69QM

RUSTSEC-2022-0085

Affected Products

Matrix-Rust-Sdk

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39252.json · Exploit
• https://github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbb · Patch
• https://github.com/matrix-org/matrix-rust-sdk/commit/41449d2cc360e347f5d4e1c154ec1e3185f11acd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39252 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39252 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vp68-2wrm-69qm · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0085 · Vendor Advisory
• https://github.com/matrix-org/matrix-rust-sdk · Note
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-vp68-2wrm-69qm · Note
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.6.0 · Note
• https://t.me/cibsecurity/50736 · Telegram Post
• https://crates.io/crates/matrix-sdk-crypto · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0085.html · Note