CVE-2025-24903

Executive Summary

CVE-2025-24903 is a critical vulnerability in the Signal messaging protocol's Rust library, libsignal-service-rs. The flaw allows any contact to forge a sync message, impersonating another device of the local user. This is due to a missing origin check on sync messages, enabling an attacker to inject malicious data into the synchronization process. The vulnerability has a CVSS score of 8.5, indicating high severity with potential for significant data integrity and confidentiality impact. The patch introduces a was_encrypted field in the Metadata struct to enforce origin verification.

Supply Chain & Package Security

This vulnerability affects the Rust crate libsignal-service-rs, which is a core component of the Signal messaging ecosystem. The library is distributed via crates.io and is used by Signal clients and servers. The lack of origin verification in sync messages could allow a malicious contact to inject forged messages, potentially leading to account takeover or data manipulation. Users and developers should update to the patched version immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

The threat level is high due to the low complexity and lack of required privileges. An attacker can exploit this remotely without user interaction, potentially compromising the integrity and confidentiality of Signal communications.

Deep Dive & Mechanics

The vulnerability resides in the sync message handling logic of libsignal-service-rs. Sync messages are used to synchronize state across multiple devices of the same user (e.g., read receipts, contact lists). The flaw is that the origin of these messages is not verified; any contact can craft a sync message that appears to come from another device of the local user.

Root Cause: The Metadata struct did not track whether a message was encrypted. Without this field, the system could not distinguish between a legitimate sync message from a trusted device and a forged one from a contact.

Attack Scenario:

1. An attacker (a contact of the victim) sends a crafted sync message to the victim's device.
2. The victim's device processes the message as if it came from another trusted device.
3. The attacker can inject malicious data, such as fake contacts, read receipts, or even trigger account actions.

Impact: This could lead to data corruption, privacy breaches, or further exploitation of the Signal protocol.

Vulnerable vs. Patched Code

Vulnerable Code (Before Patch):

// Metadata struct without was_encrypted field
struct Metadata {
    sender: String,
    timestamp: u64,
    // No origin verification
}

Patched Code (After Commit 82d70f6720e762898f34ae76b0894b0297d9b2f8):

// Metadata struct with was_encrypted field
struct Metadata {
    sender: String,
    timestamp: u64,
    was_encrypted: bool, // New field to verify origin
}

The patch adds a was_encrypted field to the Metadata struct. This field is set to true only if the message was properly encrypted by a trusted device. Sync messages that are not encrypted (or encrypted by an untrusted source) are rejected.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Signal account that is a contact of the victim.
• Ability to send messages to the victim (e.g., via the Signal protocol).

Exploitation Steps:

1. Craft a sync message with a forged sender identity (e.g., another device ID of the victim).
2. Send the message to the victim's device using the Signal protocol.
3. The victim's device processes the message as legitimate, allowing the attacker to inject data.

Example Payload (Conceptual):

# Python pseudocode for forging a sync message
import signal_protocol

# Assume we have a valid session with the victim
forged_message = signal_protocol.SyncMessage(
    sender="victim_other_device_id",
    data=malicious_payload
)
send_to_victim(forged_message)

Blue Team (Defender)

Detection:

• Monitor for sync messages that originate from unexpected devices.
• Check the was_encrypted field in the Metadata struct (after patching).
• Use network monitoring to detect anomalous message patterns.

Mitigation:

• Apply the patch immediately.
• Validate all sync messages against known device keys.
• Implement additional logging for sync message origins.

Indicators of Compromise (IOCs)

• Network: Unusual sync messages from contacts that are not trusted devices.
• Logs: Entries showing sync messages with missing or invalid encryption metadata.
• File: Modified Metadata struct in libsignal-service-rs without was_encrypted field.

Example IOC (Log Entry):

[WARN] Sync message received from unknown device: sender=contact_id, device_id=unknown

Detection Engineering

YARA Rule

rule CVE_2025_24903_Signal_Sync_Forgery {
    meta:
        description = "Detects vulnerable libsignal-service-rs Metadata struct without was_encrypted field"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-24903"
    strings:
        $metadata_struct = "struct Metadata" nocase
        $sender_field = "sender:" nocase
        $timestamp_field = "timestamp:" nocase
        $no_was_encrypted = "was_encrypted" xor
    condition:
        $metadata_struct and $sender_field and $timestamp_field and not $no_was_encrypted
}

Sigma Rule

title: CVE-2025-24903 - Signal Sync Message Forgery
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2025-24903 by monitoring for sync messages from untrusted sources.
author: Valters IT
date: 2025-04-01
logsource:
    category: application
    product: signal
detection:
    selection:
        event: "sync_message_received"
        sender: "contact"
        device_id: "unknown"
    condition: selection
falsepositives:
    - Legitimate multi-device sync from new device
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2025-24903 - Signal Sync Message Forgery"; flow:to_server; content:"|00 00 00 00|"; depth:4; content:"|01 02 03 04|"; within:10; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update libsignal-service-rs to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8 or later.
2. API Update: Adjust code to handle the new was_encrypted field in the Metadata struct.
3. Validation: Implement additional checks on sync message origins, such as verifying device keys.
4. Monitoring: Enable logging for all sync messages and alert on anomalies.
5. User Awareness: Inform users to verify new device additions and report suspicious activity.

Workarounds: No known workarounds exist; patching is required.

Valters IT