Matrix Javascript SDK Vulnerability: Message Spoofing via Malicious Homeserver
Summary
CVE-2022-39251: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Affects node-matrix-js-sdk across 2 version ranges.
< 2d067ad95778b26aed24b801be0951e215c3ac8c
< a587d7c36026fe1fcf93dfff63588abee359be76
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Matrix Javascript SDK is a client-server SDK designed for building applications that communicate over the Matrix protocol. It enables developers to create real-time communication applications, supporting features like messaging, presence, and synchronization. However, prior to version 19.7.0, the SDK was vulnerable to a protocol confusion issue that allowed attackers to spoof messages from other users when cooperating with a malicious homeserver.
Vulnerability Detail
The vulnerability arises from a protocol confusion that allows to-device messages encrypted with Megolm to be accepted instead of the intended Olm encryption. This flaw can be exploited by an attacker working with a malicious homeserver to craft messages that appear to originate from another user, potentially leading to targeted attacks. Such attacks could include injecting key backup secrets during self-verification, allowing the attacker to manipulate the key backup process and compromise user security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. However, users are advised to ensure they trust their homeserver and to upgrade to the latest version of the SDK as soon as possible to avoid potential exploitation.
Conclusion
The Matrix Javascript SDK vulnerability (CVE-2022-39251) poses significant risks due to its ability to allow message spoofing through a malicious homeserver. Users are strongly encouraged to upgrade to version 19.7.0 or later to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for node-matrix-js-sdk →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions prior to 19.7.0 of the Matrix Javascript SDK are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds, it is crucial to ensure that you trust your homeserver until you can upgrade to a secure version.
Exploitation of this vulnerability can lead to message spoofing, allowing attackers to send fake messages or manipulate key backup processes, compromising user security.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-matrix-js-sdk.
