Is CVE-2022-39251 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39251 being exploited in the wild.

How severe is CVE-2022-39251?

Low severity, with a CVSS score of 3.1, published 30 September 2022.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.

Is there a fix for CVE-2022-39251?

Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39251 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-39251?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39251: Matrix matrix-js-sdk user spoofing via protocol confusion

CVE-2022-39251 · Severity: low · CVSS 3.1 · Published 2022-09-30

Matrix's JavaScript SDK for end-to-end encrypted messaging accepts improperly encrypted messages, allowing an attacker colluding with a malicious homeserver to forge messages appearing to come from other users. An attacker could inject fake key backup secrets or other sensitive data, potentially compromising message authenticity and user verification systems without visible warnings to the recipient.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2022-39251 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39251 being exploited in the wild.
How severe is CVE-2022-39251?: Low severity, with a CVSS score of 3.1, published 30 September 2022.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.
Is there a fix for CVE-2022-39251?: Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39251 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-39251?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 19.7.0 or later
```
npm install matrix-js-sdk@19.7.0
```

Technical details

The vulnerability stems from a protocol confusion flaw in the Olm/Megolm encryption handling: the SDK incorrectly accepts to-device messages encrypted with Megolm instead of requiring the stricter Olm encryption. This allows an attacker coordinating with a malicious homeserver to construct forged messages with a legitimate origin appearance. The attack vector is network-based and requires no user interaction or special authentication. An attacker can spoof message sources, inject backdoored key backup secrets during self-verification flows, or manipulate device keys. The fix restricts to-device messages to Olm encryption only, adds validation for key backup signatures from trusted devices, and discards cleartext cryptographic material messages. Version 19.7.0 and later contain the patches.

Affected products

Matrix matrix-js-sdk <19.7.0

Identifiers

CVE-2022-39251
GHSA-r48r-j8fx-mq2c

Timeline

2022-09-28: disclosed: Security advisory published
2022-09-30: patched: Version 19.7.0 released with fixes

References

https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.