CVE-2022-39249: Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a trusted flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with trusted = false are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.
Other sources
Thunderbird users who use the Matrix chat protocol were vulnerable to an impersonation attack. A malicious server administrator could fake encrypted messages to look as if they were sent from another user on that server.
Affected Software
Remediation
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-39249?
CVE-2022-39249 is a vulnerability in Thunderbird that allows a malicious server administrator to impersonate another user on the Matrix chat protocol.
How does CVE-2022-39249 affect Thunderbird users?
CVE-2022-39249 affects Thunderbird users who use the Matrix chat protocol, as they are vulnerable to an impersonation attack.
What is the severity of CVE-2022-39249?
CVE-2022-39249 has a severity level of high.
How can a malicious server administrator exploit CVE-2022-39249?
A malicious server administrator can exploit CVE-2022-39249 by faking encrypted messages to appear as if they were sent from another user on the server.
How can Thunderbird users protect themselves from CVE-2022-39249?
To protect themselves from CVE-2022-39249, Thunderbird users should update to version 102.3.1 or later.