CVE-2022-39246: matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions
First published: Wed Sep 28 2022(Updated: )
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Matrix Software Development Kit | <1.5.1 |
Remedy
https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e
- https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1
- https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-2pvj-p485-cp3m
- https://github.com/matrix-org/matrix-spec-proposals/pull/3061
Frequently Asked Questions
What is CVE-2022-39246?
CVE-2022-39246 is a vulnerability in the Matrix SDK for Android, allowing an attacker cooperating with a malicious homeserver to construct messages appearing to have come from another person.
How does CVE-2022-39246 affect the Matrix SDK for Android?
CVE-2022-39246 affects the Matrix SDK for Android versions prior to 1.5.1, allowing an attacker to construct forged messages that appear to be from someone else.
What is the severity of CVE-2022-39246?
CVE-2022-39246 has a severity rating of high (5.3).
How can I fix CVE-2022-39246?
To fix CVE-2022-39246, upgrade to version 1.5.1 or later of the Matrix SDK for Android.
Where can I find more information about CVE-2022-39246?
You can find more information about CVE-2022-39246 at the following references: [Reference 1](https://github.com/matrix-org/matrix-android-sdk2/commit/77df720a238d17308deab83ecaa37f7a4740a17e), [Reference 2](https://github.com/matrix-org/matrix-android-sdk2/releases/tag/v1.5.1), [Reference 3](https://github.com/matrix-org/matrix-android-sdk2/security/advisories/GHSA-2pvj-p485-cp3m).
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/title
- agent/remedy
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/matrix
- canonical/matrix software development kit