CVE-2022-36009 (published 2022-08-19T21:15Z)

gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `"events_default"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `"events_default"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/matrix-org/gomatrixserverlib
commit_details: repo_url: https://github.com/matrix-org/gomatrixserverlib
author: Neil Alexander
author_date: 2022-08-15 10:19:47+01:00
msg: Fix parsing of `"events_default"` level in `m.room.power_levels` events
repository: repo_url: https://github.com/matrix-org/gomatrixserverlib
repo_name: matrix-org/gomatrixserverlib
description: Go library for matrix federation.
repo_language: Go
owner: matrix-org
file_changes: filename: eventauth_test.go
change_type: ModificationType.MODIFY
diff: @@ -1137,3 +1137,62 @@ func newMemberContent(
 		ThirdPartyInvite: thirdPartyInvite,
 	}
 }
+
+var negativePowerLevelTestRoom = &testAuthEvents{
+	CreateJSON: json.RawMessage(`{
+		"type": "m.room.create",
+		"state_key": "",
+		"sender": "@u1:a",
+		"room_id": "!r1:a",
+		"event_id": "$e1:a",
+		"content": {
+			"room_version": "10"
+		}
+	}`),
+	PowerLevelsJSON: json.RawMessage(`{
+		"type": "m.room.power_levels",
+		"state_key": "",
+		"sender": "@u1:a",
+		"room_id": "!r1:a",
+		"event_id": "$e3:a",
+		"content": {
+			"events_default": -9007199254740990,
+			"state_default": -9007199254740990,
+			"users_default": -9007199254740990,
+			"users": {
+			}
+		}
+	}`),
+	MemberJSON: map[string]json.RawMessage{
+		"@u1:a": json.RawMessage(`{
+			"type": "m.room.member",
+			"state_key": "@u1:a",
+			"sender": "@u1:a",
+			"room_id": "!r1:a",
+			"event_id": "$e2:a",
+			"content": {
+				"membership": "join"
+			}
+		}`),
+	},
+}
+
+func TestNegativePowerLevels(t *testing.T) {
+	// User should be able to demote the user default level
+	// below their own effective level.
+	eventShouldSucceed, err := NewEventFromTrustedJSON(RawJSON(`{
+		"type": "m.room.message",
+		"sender": "@u1:a",
+		"room_id": "!r1:a",
+		"event_id": "$e5:a",
+		"content": {
+			"stuff": "i am a message event"
+		}
+	}`), false, RoomVersionV1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = Allowed(eventShouldSucceed, negativePowerLevelTestRoom); err != nil {
+		t.Error("TestNegativePowerLevels should have succeeded but it didn't:", err)
+	}
+}

programming_language: Go
filename: eventcontent.go
change_type: ModificationType.MODIFY
diff: @@ -431,7 +431,7 @@ func NewPowerLevelContentFromEvent(event *Event) (c PowerLevelContent, err error
 			UsersDefaultLevel  levelJSONValue            `json:"users_default"`
 			EventLevels        map[string]levelJSONValue `json:"events"`
 			StateDefaultLevel  levelJSONValue            `json:"state_default"`
-			EventDefaultLevel  levelJSONValue            `json:"event_default"`
+			EventDefaultLevel  levelJSONValue            `json:"events_default"`
 			NotificationLevels map[string]levelJSONValue `json:"notifications"`
 		}
 		if err = json.Unmarshal(event.Content(), &content); err != nil {

programming_language: Go