libsignal-service-rs Sync Message Forgery Vulnerability

A vulnerability in libsignal-service-rs, a Rust implementation of the libsignal protocol for Signal server communication, allows any contact to forge a sync message, impersonating another device of the local user. This issue arises because the origin of sync messages is not verified. The vulnerability is present in versions prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8.

Impact

Exploitation of this vulnerability allows for the unauthorized impersonation of devices in sync message exchanges, potentially leading to miscommunication or unauthorized actions based on the forged messages.

Remediation

Users can upgrade to libsignal-service-rs version 82d70f6720e762898f34ae76b0894b0297d9b2f8 or later. Note that this version introduces a breaking change in the Metadata struct by adding a was_encrypted field.