CVE-2022-39255

Name of the Vulnerable Software and Affected Versions matrix-ios-sdk versions prior to 0.23.19

Description The issue allows an attacker cooperating with a malicious homeserver to construct messages that appear to have come from another person without indication. A sophisticated attacker could employ this vulnerability to perform a targeted attack, sending fake to-device messages appearing to originate from another user. This can allow the injection of the key backup secret during self-verification or making a targeted device use a malicious key backup spoofed by the homeserver. The attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.

Recommendations For versions prior to 0.23.19, update to version 0.23.19 or later to only accept Olm-encrypted to-device messages. As a temporary workaround, consider not verifying new logins using emoji/QR verification methods until patched. To minimize the risk of exploitation, ensure that you trust your homeserver, as the attack requires coordination between a malicious homeserver and an attacker.