PT-2025-7045 · Unknown · Libsignal-Service-Rs

Valldrac · Published 2025-02-13 · Updated 2025-02-17 · CVE-2025-24903

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: libsignal-service-rs versions prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8

Description: The issue allows any contact to forge a sync message, impersonating another device of the local user, because the origin of sync messages is not checked. The Metadata struct contains an additional was encrypted field, which breaks the API, but should be easily resolvable. No known workarounds are available.

Recommendations: For versions prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, update to a version after commit 82d70f6720e762898f34ae76b0894b0297d9b2f8 to resolve the issue. As a temporary workaround, consider implementing additional validation for the origin of sync messages until a patched version is available. Restrict access to sensitive functionality that relies on the Metadata struct until the API compatibility issue is resolved.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2025-24903

GHSA-R58Q-66G9-H6G8

Affected Products

Libsignal-Service-Rs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24903.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24903 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24903 · Vendor Advisory
• https://github.com/whisperfish/libsignal-service-rs/commit/82d70f6720e762898f34ae76b0894b0297d9b2f8 · Note
• https://github.com/whisperfish/libsignal-service-rs/security/advisories/GHSA-r58q-66g9-h6g8 · Note
• https://twitter.com/CVEnew/status/1890150872979816458 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1890215679510315399 · Twitter Post
• https://t.me/cvedetector/18036 · Telegram Post
• https://twitter.com/cybercronai/status/1891480358543110178 · Twitter Post