CVE-2021-40823 matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver

What is CVE-2021-40823?

CVE-2021-40823 is a medium-severity vulnerability in n/a, published on 13 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.

Weakness: CWE-290

Which versions are affected by CVE-2021-40823?

2 open source packages ship an affected version, including matrix-js-sdk. It affects 1 product.

Products include Matrix Javascript Sdk.

How do I fix CVE-2021-40823?

Upgrade matrix-js-sdk to 12.4.1 or later.

Is CVE-2021-40823 being exploited?

There is no known exploitation of CVE-2021-40823 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-39250 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification High 8.6
• CVE-2022-39251 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion High 8.6
• CVE-2022-36059 Prototype pollution in matrix-js-sdk High 8.2
• CVE-2023-28427 Prototype pollution in matrix-js-sdk High 8.2
• CVE-2022-39249 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2024-FT51773, DEBIAN-CVE-2021-40823, GHSA-23cm-x6j7-6hq3, UBUNTU-CVE-2021-40823.