CVE-2025-31126

Executive Summary

CVE-2025-31126 is a medium-severity vulnerability in Element X iOS, a Matrix client. The flaw allows an attacker who controls the element.json well-known file to potentially access media encryption keys used during Element Call sessions. This is a client-side trust issue where the application implicitly trusts the well-known file served by the homeserver, which can be manipulated under certain conditions (e.g., compromised homeserver, DNS spoofing, or man-in-the-middle attacks). The vulnerability affects versions between 1.6.13 and 25.03.7 and is fixed in version 25.03.8.

Supply Chain & Package Security

This vulnerability is specific to the Element X iOS application, which is distributed via the Apple App Store. There is no NPM, PyPI, Go, or Ruby package involved. The risk is primarily to end-users who have not updated their app. The supply chain risk is low, as the attack requires control over the well-known file, which is typically served by the user's homeserver.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector (AV): Network (N) – The attack is conducted over the network.
• Attack Complexity (AC): High (H) – The attacker must control the element.json well-known file, which requires compromising the homeserver or performing a man-in-the-middle attack.
• Privileges Required (PR): None (N) – No authentication required.
• User Interaction (UI): Required (R) – The user must be in an Element Call session.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Media encryption keys are exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack complexity is high, but successful exploitation could lead to unauthorized decryption of media streams in Element Call.

Deep Dive & Mechanics

The vulnerability lies in how Element X iOS processes the element.json well-known file. This file is fetched from the user's homeserver (e.g., https://example.com/.well-known/element.json) and contains configuration data, including settings for Element Call. In affected versions, the client does not properly validate the origin or integrity of the encryption keys provided in this file. An attacker who can control the well-known file (e.g., through a compromised homeserver, DNS spoofing, or a man-in-the-middle attack) can inject malicious encryption keys. When a user initiates an Element Call, the client uses these keys to encrypt media, allowing the attacker to decrypt the call.

The attack flow:

1. Attacker gains control over the element.json well-known file (e.g., by compromising the homeserver or performing a man-in-the-middle attack).
2. Attacker modifies the file to include attacker-controlled encryption keys.
3. User starts an Element Call; the client fetches the malicious well-known file and uses the attacker's keys.
4. Attacker can now decrypt the media stream.

Vulnerable vs. Patched Code

Vulnerable Code (pre-25.03.8):

// In ElementX iOS, the well-known file is fetched and parsed without validation
func fetchWellKnown() -> WellKnown? {
    guard let url = URL(string: "https://\(homeserver)/.well-known/element.json") else { return nil }
    let data = try? Data(contentsOf: url)
    let decoder = JSONDecoder()
    return try? decoder.decode(WellKnown.self, from: data)
}

Patched Code (25.03.8):

// The patched version validates the origin and integrity of the well-known file
func fetchWellKnown() -> WellKnown? {
    guard let url = URL(string: "https://\(homeserver)/.well-known/element.json") else { return nil }
    // Validate the server certificate and ensure the response is from the expected homeserver
    let session = URLSession(configuration: .default, delegate: self, delegateQueue: nil)
    let task = session.dataTask(with: url) { data, response, error in
        guard let data = data, let httpResponse = response as? HTTPURLResponse, httpResponse.statusCode == 200 else { return }
        // Additional validation: check that the response is not tampered with
        let decoder = JSONDecoder()
        if let wellKnown = try? decoder.decode(WellKnown.self, from: data) {
            // Verify that the encryption keys match expected values (e.g., from a trusted source)
            if validateKeys(wellKnown) {
                return wellKnown
            }
        }
    }
    task.resume()
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Control over the element.json well-known file (e.g., compromised homeserver or man-in-the-middle position).
• Target user running Element X iOS version between 1.6.13 and 25.03.7.

Steps:

1. Set up a malicious homeserver or intercept traffic to the legitimate homeserver.
2. Modify the element.json file to include attacker-controlled encryption keys:

   {
     "call": {
       "encryption_keys": ["attacker_public_key_base64"]
     }
   }
   

3. Wait for the target to initiate an Element Call.
4. Capture the encrypted media stream and decrypt using the attacker's private key.

Blue Team (Defender)

Detection:

• Monitor for unusual modifications to the element.json file on the homeserver.
• Use network monitoring to detect man-in-the-middle attacks (e.g., unexpected certificate changes).
• Alert on clients fetching well-known files from unexpected sources.

Hunting:

• Check logs for clients requesting /.well-known/element.json with unusual user-agent strings.
• Analyze DNS queries for signs of spoofing.

Indicators of Compromise (IOCs)

• Network: Unusual requests to /.well-known/element.json from clients with unexpected IPs.
• File: Modified element.json file on the homeserver containing unknown encryption keys.
• Behavior: Element Call sessions with unexpected encryption key fingerprints.

Detection Engineering

YARA Rule

rule CVE_2025_31126_ElementX_iOS {
    meta:
        description = "Detects malicious element.json files with attacker-controlled encryption keys"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31126"
    strings:
        $key_field = "\"encryption_keys\""
        $json_start = "{\"call\":"
    condition:
        $json_start at 0 and $key_field
}

Sigma Rule

title: CVE-2025-31126 - Element X iOS Well-Known File Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-31126 by monitoring for unusual element.json requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/.well-known/element.json'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate client updates
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31126 - Element X iOS Well-Known File Access"; flow:to_server; http.uri; content:"/.well-known/element.json"; http.method; content:"GET"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update Element X iOS to version 25.03.8 or later.
• Verify the integrity of the element.json file on your homeserver.

Long-term:

• Implement certificate pinning in the client to prevent man-in-the-middle attacks.
• Use signed well-known files to ensure authenticity.
• Monitor for unauthorized changes to well-known files.

Workarounds:

• Disable Element Call until the update is applied.
• Use a VPN to reduce the risk of man-in-the-middle attacks.

Valters IT
Securing Digital Frontiers