7.5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2022-39246

GHSA ID

GHSA-2pvj-p485-cp3m

EPSS Score

0.34706%

CWE

CWE-287

Published

9/30/2022

Updated

1/29/2023

KEV Status

Technology

Java

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-39246

CVE-2022-39246: matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions

Impact

An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others.

This attack is possible due to the matrix-android-sdk2 implementing a too permissive key forwarding strategy on the receiving end.

Key forwarding is a mechanism allowing clients to recover from “unable to decrypt” messages when they missed the initial key distribution, at the time the message was originally sent. Examples include accessing message history before they joined the room but also when some network/federation errors have occurred.

Patches

The default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices.

A unique exception to this rule is with the experimental MSC3061, that is forwarding room keys for past messages when invited in a room configured with the proper history visibility setting. Such key forwards are parked upon receipt and are only accepted if the SDK receives an invitation for that room from the inviter in a limited time window.

The SDK now sets a trusted flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with trusted = false are decorated appropriately (for example, by showing a warning for such messages).

Workarounds

Current users of the SDK can disable key forwarding in their forks using CryptoService#enableKeyGossiping(enable: Boolean).

References

Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.

(GitHub Advisory)

7.5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2022-39246

GHSA ID

GHSA-2pvj-p485-cp3m

EPSS Score

0.34706%

CWE

CWE-287

Published

9/30/2022

Updated

1/29/2023

KEV Status

Technology

Java

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.matrix.android:matrix-android-sdk2	maven	<= 1.4.36	1.5.1

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from improper validation of forwarded Megolm keys. The key functions MXMegolmDecryption.onRoomKeyEvent and MXOlmDevice.addInboundGroupSession lacked critical checks for: 1) Whether keys were requested 2) Device verification status 3) Trust chain validation. The patch added 'trusted' flags, request validation through UnRequestedForwardManager, and strict checks against the crypto config's limitRoomKeyRequestsToMyDevices setting. These functions were directly involved in the permissive key acceptance logic that allowed malicious homeservers to inject spoofed messages.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n *tt**k*r *oop*r*tin* wit* * m*li*ious *om*s*rv*r **n *onstru*t m*ss***s *pp**rin* to **v* *om* *rom *not**r p*rson. Su** m*ss***s will ** m*rk** wit* * *r*y s*i*l* on som* pl*t*orms, *ut t*is m*y ** missin* in ot**rs. T*is *tt**k is po

Reasoning

T** vuln*r**ility st*mm** *rom improp*r `v*li**tion` o* *orw*r*** M**olm k*ys. T** k*y *un*tions `MXM**olm***ryption.onRoomK*y*v*nt` *n* `MXOlm**vi**.***In*oun**roupS*ssion` l**k** *riti**l ****ks *or: *) W**t**r k*ys w*r* r*qu*st** *) **vi** v*ri*i*

7.5

Basic Information

Concerned about an active attack path?

CVE-2022-39246: matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions

Impact

Patches

Workarounds

References

For more information

7.5

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI