Vulnerability · Published Apr 14, 2023 · Assigned by GitHub_M
CVE-2023-29529matrix-js-sdk vulnerable to invisible eavesdropping in group calls
Medium 5.0
In plain English
A medium-severity missing authorization in matrix-js-sdk from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | node-matrix-js-sdk | no fix listed | UBUNTU-CVE-2023-29529 |
| Ubuntu:24.04:LTS | node-matrix-js-sdk | no fix listed | UBUNTU-CVE-2023-29529 |
| npm | matrix-js-sdk | 24.1.0 | GHSA-6g67-q39g-r79q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | matrix-js-sdk | < 24.1.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6g67-q39g-r79q x_refsource_CONFIRM
- https://github.com/matrix-org/matrix-spec-proposals/pull/3401 x_refsource_MISC
- https://github.com/matrix-org/matrix-js-sdk/releases/tag/v24.1.0 x_refsource_MISC