Description
An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 24.1.0
- Patched version(s): 24.1.0
References
Could your website be exposed too?
SmartScanner can check your website for matrix-js-sdk vulnerable to invisible eavesdropping in group calls and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype pollution in matrix-js-sdk (part 2) - CVE-2023-28427
- matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor - CVE-2024-42369
- Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
- Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
You might also like:
See something that needs correcting? Let us knowUpdated April 25, 2023