Executive brief
The matrix-js-sdk is a JavaScript library used by Matrix messaging applications to communicate with Matrix servers. Malformed beacon events can cause the SDK to malfunction or exclude/corrupt data, making chat applications appear to work normally while silently losing or corrupting user messages and other runtime data.
Technical details
This vulnerability is a logic error in how matrix-js-sdk processes beacon events defined in Matrix Spec Proposal 3488. Improperly formed beacon events can trigger improper data handling in the SDK, disrupting normal operation and potentially causing data loss or corruption. The attack vector is network-based and requires low privileges (an authenticated user or external attacker sending malformed events). The SDK may continue to appear functional while excluding or corrupting runtime data. The vulnerability affects versions 17.1.0-rc.1 through 19.6.x and is patched in v19.7.0. Workarounds include redacting malicious events, clearing storage, or restarting the client.
Affected products
- matrix-org matrix-js-sdk 17.1.0-rc.1 through 19.6.x
Timeline
- 2022-09-28: disclosed: Publicly disclosed on GitHub and NVD
- 2022-09-28: patched: Fixed in matrix-js-sdk v19.7.0
- 2022-09-29: other: OSV entry published