Is CVE-2022-39249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39249 being exploited in the wild.

How severe is CVE-2022-39249?

Low severity, with a CVSS score of 3.1, published 30 September 2022.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.

Is there a fix for CVE-2022-39249?

Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39249 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-39249?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39249: matrix-js-sdk message impersonation via permissive key forwarding

CVE-2022-39249 · Severity: low · CVSS 3.1 · Published 2022-09-30

matrix-js-sdk is a JavaScript client library for the Matrix messaging protocol, used by many popular encrypted chat applications. The library incorrectly accepted encrypted message keys from any source, allowing an attacker cooperating with a malicious Matrix server to forge messages appearing to come from other users. While such forged messages display a warning shield on some platforms, this protection may be missing or ineffective on others.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2022-39249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39249 being exploited in the wild.
How severe is CVE-2022-39249?: Low severity, with a CVSS score of 3.1, published 30 September 2022.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.
Is there a fix for CVE-2022-39249?: Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39249 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-39249?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 19.7.0 or later
```
npm install matrix-js-sdk@19.7.0
```

Technical details

This vulnerability affects the key forwarding mechanism in matrix-js-sdk, which normally allows clients to recover encrypted messages they missed (e.g., when accessing chat history or after network errors). The SDK implemented an overly permissive policy by accepting forwarded encryption keys from untrusted sources without sufficient validation. An attacker colluding with a malicious homeserver can exploit this to send specially crafted Megolm session keys, allowing them to construct messages that appear to originate from legitimate users. The fix tightens the forwarding policy to only accept keys in response to explicit requests and only from the user's own verified devices. Additionally, a "trusted" flag is now set on decrypted messages to indicate key source trustworthiness, requiring clients to display appropriate warnings for untrusted keys. The vulnerability was patched in matrix-js-sdk v19.7.0 released on 2022-09-28.

Affected products

matrix-org matrix-js-sdk all versions before 19.7.0

Identifiers

CVE-2022-39249
GHSA-6263-x97c-c4gg

Timeline

2022-09-28: disclosed
2022-09-28: patched: matrix-js-sdk v19.7.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.