PT-2022-24847 · Unknown · Matrix Ios Sdk
Benjamin Dowling
+3
·
Published
2022-09-28
·
Updated
2022-09-30
·
CVE-2022-39255
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
matrix-ios-sdk versions prior to 0.23.19
Description
The issue allows an attacker cooperating with a malicious homeserver to construct messages that appear to have come from another person without indication. A sophisticated attacker could employ this vulnerability to perform a targeted attack, sending fake to-device messages appearing to originate from another user. This can allow the injection of the key backup secret during self-verification or making a targeted device use a malicious key backup spoofed by the homeserver. The attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.
Recommendations
For versions prior to 0.23.19, update to version 0.23.19 or later to only accept Olm-encrypted to-device messages.
As a temporary workaround, consider not verifying new logins using emoji/QR verification methods until patched.
To minimize the risk of exploitation, ensure that you trust your homeserver, as the attack requires coordination between a malicious homeserver and an attacker.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Matrix Ios Sdk