CVE-2023-29529 matrix-js-sdk vulnerable to invisible eavesdropping in group calls
An attacker in a Matrix group call can secretly eavesdrop on audio and video without appearing as a participant due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29529?
CVE-2023-29529 is a medium-severity missing authorization vulnerability in matrix-org matrix-js-sdk, published on 14 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.
Weakness: CWE-862
Which versions are affected by CVE-2023-29529?
2 open source packages ship an affected version, including matrix-js-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-js-sdk npm | All versions | 24.1.0 |
matrix-js-sdk npm | All versions | 24.1.0 |
Products include Matrix Javascript Sdk.
How do I fix CVE-2023-29529?
Upgrade matrix-js-sdk to 24.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-29529 being exploited?
There is no known exploitation of CVE-2023-29529 in the wild and no public exploit code.
Other vulnerabilities in matrix-org matrix-js-sdk
- CVE-2022-39250 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
- CVE-2022-39251 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
- CVE-2022-36059 Prototype pollution in matrix-js-sdk
- CVE-2023-28427 Prototype pollution in matrix-js-sdk
- CVE-2022-39249 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Sources
Also known as DEBIAN-CVE-2023-29529, GHSA-6g67-q39g-r79q, UBUNTU-CVE-2023-29529.