CVE-2022-39254 When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder

2022-09-2914:35:10

CWE-322

CWE-287

GitHub_M

www.cve.org

matrix-nio

python matrix client

sans i/o

room keys

impersonation attack

cve-2022-39254

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.

CNA Affected

[
  {
    "product": "matrix-nio",
    "vendor": "poljar",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.20"
      }
    ]
  }
]