Headline
CVE-2022-36009: Fix parsing of `"events_default"` level in `m.room.power_levels` events · matrix-org/gomatrixserverlib@723fd49
gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the "events_default" key of the m.room.power_levels event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the "events_default" power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit 723fd49 and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the "events_default" power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.
@@ -1137,3 +1137,62 @@ func newMemberContent( ThirdPartyInvite: thirdPartyInvite, } }
var negativePowerLevelTestRoom = &testAuthEvents{ CreateJSON: json.RawMessage(`{ "type": "m.room.create", "state_key": "", "sender": "@u1:a", "room_id": "!r1:a", "event_id": "$e1:a", "content": { "room_version": “10” } }`), PowerLevelsJSON: json.RawMessage(`{ "type": "m.room.power_levels", "state_key": "", "sender": "@u1:a", "room_id": "!r1:a", "event_id": "$e3:a", "content": { "events_default": -9007199254740990, "state_default": -9007199254740990, "users_default": -9007199254740990, "users": { } } }`), MemberJSON: map[string]json.RawMessage{ "@u1:a": json.RawMessage(`{ "type": "m.room.member", "state_key": "@u1:a", "sender": "@u1:a", "room_id": "!r1:a", "event_id": "$e2:a", "content": { "membership": “join” } }`), }, }
func TestNegativePowerLevels(t *testing.T) { // User should be able to demote the user default level // below their own effective level. eventShouldSucceed, err := NewEventFromTrustedJSON(RawJSON(`{ "type": "m.room.message", "sender": "@u1:a", "room_id": "!r1:a", "event_id": "$e5:a", "content": { "stuff": “i am a message event” } }`), false, RoomVersionV1) if err != nil { t.Fatal(err) } if err = Allowed(eventShouldSucceed, negativePowerLevelTestRoom); err != nil { t.Error("TestNegativePowerLevels should have succeeded but it didn’t:", err) } }
Related news
### Impact The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. In rooms where the `"events_default"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. ### Patches gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. ### Workarounds Matrix rooms where the `"events_default"` power level has not been changed from the default of zero are not vulnerable. ### For more information If you have any questions or comments about this advisory, e-mail us at [[email protected]](mailto:[email protected]).