Is CVE-2022-39250 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39250 being exploited in the wild.

How severe is CVE-2022-39250?

Low severity, with a CVSS score of 3.1, published 30 September 2022.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.

Is there a fix for CVE-2022-39250?

Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39250 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-39250?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39250: Matrix.js SDK user impersonation in SAS verification

CVE-2022-39250 · Severity: low · CVSS 3.1 · Published 2022-09-30

matrix-js-sdk is a JavaScript library used by Matrix chat clients like Element to handle end-to-end encrypted messaging. A vulnerability in the verification process (SAS verification) allows a malicious server operator to inject their own identity during user verification, causing other users to trust the wrong party. This attack enables account takeover and impersonation of users during encrypted conversations.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2022-39250 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39250 being exploited in the wild.
How severe is CVE-2022-39250?: Low severity, with a CVSS score of 3.1, published 30 September 2022.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.
Is there a fix for CVE-2022-39250?: Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39250 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-39250?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 19.7.0 or later
```
npm install matrix-js-sdk@19.7.0
```

Technical details

This is an authentication bypass vulnerability (CWE-287) in matrix-js-sdk's Short Authentication String (SAS) verification mechanism. The root cause is a key/device identifier confusion bug: the SDK checks and signs user identities and devices in two separate steps without adequately locking the keys between those steps. Since cross-signing user identities are represented as Matrix devices on the server side, an attacker cooperating with a malicious homeserver can substitute their own identity key. The attack requires network-level access (cooperation with the homeserver) and occurs during the SAS verification handshake. An attacker can break emoji-based verification and cause a user's client to trust a server-controlled identity instead of the intended user's identity. The vulnerability was patched in matrix-js-sdk v19.7.0 by double-checking that the key signed matches the key that was verified, and by rejecting device IDs that match cross-signing key formats.

Affected products

Matrix.org matrix-js-sdk < 19.7.0

Identifiers

CVE-2022-39250
GHSA-5w8r-8pgj-5jmf

Timeline

2022-09-28: disclosed: Public blog post and coordinated disclosure
2022-09-28: patched: Fixed in matrix-js-sdk v19.7.0
2022-09-30: advisory: GHSA-5w8r-8pgj-5jmf published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.