CVE-2022-39835
Medium · 5.3CVSS
5.3
EPSS
0.6%
Published
Sep 27, 2022
CISA due date
—
Cloudanix analysis
A flaw in a popular chat program let people who were already in a conversation secretly change messages they did not originally write.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Tampering
- Component
- Application
- Class
- Authorization Bypass
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Allows unauthorized correction of messages via crafted XML stanzas in XMPP chats; attacker must already be a participant in the single or group chat.
Why it matters to the business
Attackers already inside a chat can silently alter message history, enabling misinformation, impersonation, or confusion that disrupts reliable team or customer communications.
How an attack unfolds
An attacker who is already a member of a Gajim chat sends specially crafted XML correction stanzas that bypass the sender check, allowing them to edit any prior message in the conversation history.
How to fix it
Upgrade Gajim to version 1.5.0 or later on all affected systems; verify the installed version after upgrade and restart the client.
How to confirm the fix worked
Confirm Gajim reports version 1.5.0 or higher; attempt to send a correction stanza for a message not authored by the current user and verify the client rejects it.
Typical attack path
- Obtain membership in the target single or group chat
- Craft malicious XML correction stanzas referencing arbitrary prior messages
- Transmit the stanzas over the XMPP connection
- Observe successful unauthorized message corrections in the chat history
How to detect it
Review XMPP server or client logs for correction stanzas that reference message IDs not originally authored by the sending JID; correlate with chat history for unexpected edits.
What your security team should do
- Prioritize upgrade of all Gajim installations to 1.5.0 or newer within standard patch windows
- Audit chat participant lists for unexpected members until upgrades complete
- Monitor for any reports of unexpected message edits in XMPP logs
The record
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | gajim | 0 | No fix |
| Debian:12 | gajim | 0 | 1.5.0-1 |
| Debian:13 | gajim | 0 | 1.5.0-1 |
| Debian:14 | gajim | 0 | 1.5.0-1 |
| Ubuntu:16.04:LTS | gajim | 0 | No fix |
| Ubuntu:18.04:LTS | gajim | 0 | No fix |
| Ubuntu:20.04:LTS | gajim | 0 | No fix |
| Ubuntu:22.04:LTS | gajim | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | gajim | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | gajim | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | gajim | 0 | No fix |
| openSUSE:Tumbleweed | gajim | 0 | 1.5.1-1.1 |