CVE-2021-40823
published 2021-09-13CVE-2021-40823: A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in…
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.66%
47.9th percentile
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-matrix-js-sdk | — | — |
| matrix-org | matrix-js-sdk | >= 0 < 12.4.1 | 12.4.1 |
| matrix | javascript_sdk | < 12.4.1 | 12.4.1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
osv·2021-09-14
CVE-2021-40823 [MEDIUM] matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
### Impact
A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
† Or anyone with access to the account of the original recipient of an encrypted message.
Known clients affected (via their use of vulnerable versions of matrix-js-sdk):
- Element Web (1.8.2 and earlier)
- Element Desktop (1.8.2 and earlier)
- SchildiChat Web (1.7.32-sc1 and earlier)
- SchildiChat Desktop (1.7.32-sc1 and earlier)
- Cinny (1.2.0 and earlie
GHSA
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
ghsa·2021-09-14
CVE-2021-40823 [MEDIUM] CWE-200 matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
### Impact
A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
† Or anyone with access to the account of the original recipient of an encrypted message.
Known clients affected (via their use of vulnerable versions of matrix-js-sdk):
- Element Web (1.8.2 and earlier)
- Element Desktop (1.8.2 and earlier)
- SchildiChat Web (1.7.32-sc1 and earlier)
- SchildiChat Desktop (1.7.32-sc1 and earlier)
- Cinny (1.2.0 and earlie
OSV
CVE-2021-40823: A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
osv·2021-09-13·CVSS 5.9
CVE-2021-40823 [MEDIUM] CVE-2021-40823: A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
Debian
CVE-2021-40823: node-matrix-js-sdk - A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix...
vendor_debian·2021·CVSS 5.9
CVE-2021-40823 [MEDIUM] CVE-2021-40823: node-matrix-js-sdk - A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix...
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-13
Published