Critical Vulnerability in python-matrix-nio: Impersonation Risk Due to Room Key Handling Flaw
Summary
UBUNTU-CVE-2022-39254: matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Affects python-matrix-nio versions 0.16.0-1 – 0.19.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-matrix-nio is a Python Matrix client library designed to facilitate communication over the Matrix protocol. It allows developers to build applications that can interact with Matrix servers, providing features such as messaging, presence, and room management. The library is built with sans I/O principles, ensuring efficient handling of asynchronous operations. However, prior to version 0.20, it exhibited a significant vulnerability related to the handling of room keys, which could lead to impersonation attacks.
Vulnerability Detail
The vulnerability arises from the way python-matrix-nio handles room key requests. Before version 0.20, when a user requests a room key from their devices, the library correctly remembers the request. However, upon receiving a forwarded room key, it accepts the key without verifying its origin. This flaw allows malicious homeservers to potentially insert invalid room keys, enabling impersonation attacks where an attacker could masquerade as another user in a chat room. The CVSS score for this vulnerability is 8.6, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their Matrix clients by avoiding the use of untrusted homeservers until they can update to the patched version. Additionally, users should be cautious about accepting room keys from unknown sources.
Conclusion
The vulnerability in python-matrix-nio poses a significant risk of impersonation attacks due to improper handling of room keys. Users are strongly advised to update to version 0.20 or later to mitigate this risk. For those unable to update immediately, implementing temporary workarounds is recommended to protect sensitive communications.
See every vulnerability recorded for python-matrix-nio →
FAQ
The vulnerability allows attackers to impersonate users by injecting invalid room keys, potentially leading to unauthorized access to private conversations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to 0.20 are vulnerable to this impersonation attack due to improper handling of room keys.
Yes, the vulnerability is fixed in version 0.20 and later of the python-matrix-nio package.
If immediate updates are not possible, limit the use of untrusted homeservers and be cautious about accepting room keys from unknown sources.
Related vulnerabilities
Recent vulnerabilities recorded for python-matrix-nio.
