matrix-ios-sdk up to 0.23.18 Message key exchange without entity authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in matrix-ios-sdk up to 0.23.18. Affected is an unknown function of the component Message Handler. The manipulation results in key exchange without entity authentication. This vulnerability is identified as CVE-2022-39255. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in matrix-ios-sdk up to 0.23.18. Affected is some unknown functionality of the component Message Handler. The manipulation with an unknown input leads to a key exchange without entity authentication vulnerability. CWE is classifying the issue as CWE-322. The product performs a key exchange with an actor without verifying the identity of that actor. This is going to have an impact on integrity. CVE summarizes:

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-ios-sdk version 0.23.19 has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. To avoid malicious backup attacks, one should not verify one's new logins using emoji/QR verifications methods until patched.

The weakness was released 09/29/2022 as GHSA-hw6g-j8v6-9hcm. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2022-39255 since 09/02/2022. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.23.19 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5ca86c328a5faaab429c240551cb9ca8f0f6262c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• matrix-ios-sdk

Version

• 0.23.0
• 0.23.1
• 0.23.2
• 0.23.3
• 0.23.4
• 0.23.5
• 0.23.6
• 0.23.7
• 0.23.8
• 0.23.9
• 0.23.10
• 0.23.11
• 0.23.12
• 0.23.13
• 0.23.14
• 0.23.15
• 0.23.16
• 0.23.17
• 0.23.18

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion