CVE-2022-41904 Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions
A malicious homeserver can inject unverified messages into Element iOS chats without triggering security warnings, bypassing user trust indicators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41904?
CVE-2022-41904 is a medium-severity vulnerability in vector-im element-ios, published on 11 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.
Weakness: CWE-357
Which versions are affected by CVE-2022-41904?
It affects 1 product.
Products include Element Element.
How do I fix CVE-2022-41904?
No fix has been published for CVE-2022-41904 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41904 being exploited?
There is no known exploitation of CVE-2022-41904 in the wild and no public exploit code.
Other vulnerabilities in vector-im element-ios
Sources
Also known as GHSA-fm8m-99j7-323g.