CVE-2021-40823: Matrix matrix-js-sdk E2EE room key disclosure to homeservers

CVE-2021-40823 · Severity: low · CVSS 3.1 · Published 2021-09-14

A security flaw in the Matrix JavaScript SDK, used by popular messaging apps like Element and Cinny, could allow a malicious server administrator to intercept private, encrypted messages. By exploiting a logic error in how encryption keys are shared between devices, an attacker who controls a participating server or a user's account can trick a victim's app into handing over the keys needed to read past conversations. This undermines the core privacy guarantee of end-to-end encryption for affected users.

Technologies: Element Web, matrix-js-sdk (npm). Vendors: Element, npm.

Quick answers

Is CVE-2021-40823 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-40823 being exploited in the wild.
How severe is CVE-2021-40823?
Low severity, with a CVSS score of 3.1, published 14 September 2021.
Which products and versions are affected?
Cinny <= 1.2.0; Element Desktop <= 1.8.2; Element Web <= 1.8.2; matrix-js-sdk (npm) SEMVER:introduced=0,fixed=12.4.1; and 2 more.
Is there a fix for CVE-2021-40823?
Yes. matrix-js-sdk (npm): upgrade to 12.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-40823 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-40823?
Check whether you run Cinny, Element Desktop, Element Web or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-js-sdk (npm): upgrade to 12.4.1 or later
    npm install matrix-js-sdk@12.4.1

Technical details

A logic error exists in the room key sharing functionality of matrix-js-sdk before version 12.4.1. The vulnerability stems from inadequate identity verification during the key re-sharing process (CWE-322/CWE-290), where the SDK fails to properly verify the target device key. A malicious Matrix homeserver participating in an encrypted room, or an attacker with access to a recipient's account, can send crafted protocol messages to trick a victim's client into disclosing E2EE keys for messages previously sent by that client. This allows the attacker to decrypt end-to-end encrypted communications. The issue is fixed in matrix-js-sdk v12.4.1 by ensuring target device keys are verified on reshare.

Affected products

  • Matrix.org matrix-js-sdk < 12.4.1
  • Element Element Web <= 1.8.2
  • Element Element Desktop <= 1.8.2
  • SchildiChat SchildiChat Web <= 1.7.32-sc1
  • SchildiChat SchildiChat Desktop <= 1.7.32-sc1
  • Cinny Cinny <= 1.2.0

Identifiers

  • CVE-2021-40823
  • GHSA-23cm-x6j7-6hq3

Timeline

  • 2021-09-13: patched: v12.4.1 released
  • 2021-09-13: advisory: Vendor blog post disclosure
  • 2021-09-14: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.