Description
An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 19.7.0
- Patched version(s): 19.7.0
References
Could your website be exposed too?
SmartScanner can check your website for matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-js-sdk subject to impersonated messages due to permissive key forwarding - CVE-2022-39249
- matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion - CVE-2022-39251
- Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
- matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor - CVE-2024-42369
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023