matrix-ios-sdk up to 0.23.18 Message key exchange without entity authentication

Summaryinfo

A vulnerability labeled as critical has been found in matrix-ios-sdk up to 0.23.18. This issue affects some unknown processing of the component Message Handler. The manipulation results in key exchange without entity authentication. This vulnerability is known as CVE-2022-39257. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in matrix-ios-sdk up to 0.23.18. Affected is an unknown part of the component Message Handler. The manipulation with an unknown input leads to a key exchange without entity authentication vulnerability. CWE is classifying the issue as CWE-322. The product performs a key exchange with an actor without verifying the identity of that actor. This is going to have an impact on integrity. CVE summarizes:

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-ios-sdk implementing a too permissive key forwarding strategy. The default policy for accepting key forwards has been made more strict in the matrix-ios-sdk version 0.23.19. matrix-ios-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.

The weakness was published 09/29/2022 as GHSA-qxr3-5jmq-xcf4. The advisory is available at github.com. This vulnerability is traded as CVE-2022-39257 since 09/02/2022. The technical details are unknown and an exploit is not available.

Upgrading to version 0.23.19 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5ca86c328a5faaab429c240551cb9ca8f0f6262c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• matrix-ios-sdk

Version

• 0.23.0
• 0.23.1
• 0.23.2
• 0.23.3
• 0.23.4
• 0.23.5
• 0.23.6
• 0.23.7
• 0.23.8
• 0.23.9
• 0.23.10
• 0.23.11
• 0.23.12
• 0.23.13
• 0.23.14
• 0.23.15
• 0.23.16
• 0.23.17
• 0.23.18

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion