Is CVE-2023-29529 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-29529 being exploited in the wild.

How severe is CVE-2023-29529?

Low severity, with a CVSS score of 3.1, published 14 April 2023.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=24.1.0.

Is there a fix for CVE-2023-29529?

Yes. matrix-js-sdk (npm): upgrade to 24.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-29529 attacked?

It is attacked over the network.

Am I affected by CVE-2023-29529?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-29529: matrix-js-sdk unauthorized eavesdropping in group calls

CVE-2023-29529 · Severity: low · CVSS 3.1 · Published 2023-04-14

matrix-js-sdk is a JavaScript library used to build Matrix (instant messaging) clients. An attacker who joins a chat room can silently eavesdrop on video and audio from group calls without appearing as a participant, exposing the private conversations and media of other users. This could lead to espionage, harassment, or leakage of sensitive information discussed during calls.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2023-29529 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-29529 being exploited in the wild.
How severe is CVE-2023-29529?: Low severity, with a CVSS score of 3.1, published 14 April 2023.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=24.1.0.
Is there a fix for CVE-2023-29529?: Yes. matrix-js-sdk (npm): upgrade to 24.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-29529 attacked?: It is attacked over the network.
Am I affected by CVE-2023-29529?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 24.1.0 or later
```
npm install matrix-js-sdk@24.1.0
```

Technical details

This vulnerability is a missing authorization flaw (CWE-862) in the MSC3401 group call implementation. The library accepts incoming direct calls from users who have not yet declared intent to participate in the group call as part of race condition handling, but fails to restrict access to the caller's outbound media. An attacker in the same room can initiate a direct call and receive audio/video without authorization checks. The attack requires the attacker to be present in the room (low privilege required, network-reachable) and affects all versions prior to 24.1.0. Legacy 1:1 calls are unaffected. A patch is available in version 24.1.0 and later.

Affected products

Element (formerly Riot.im) matrix-js-sdk before 24.1.0

Identifiers

CVE-2023-29529
GHSA-6g67-q39g-r79q

Timeline

2023-04-14: disclosed: Advisory published
2023-04-14: patched: Fixed in version 24.1.0

References

https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6g67-q39g-r79q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.