Matrix Fuzzing

Matrix fuzzing is a dumb fuzzer fuzzing a few matrix endpoints. It requires a HS and a user to exist.

Project room

#matrix-fuzz:midnightthoughts.space

Current targets

/_matrix/client/v3/createRoom - tests::tests::fuzz_create_room - createRoom

Usage of fuzzcheck-rs

Create a HS
Setup a user
Set MATRIX_USERNAME and MATRIX_PASSWORD to the username and password of the user you want to fuzz as.
Install fuzzcheck -> https://github.com/loiclec/fuzzcheck-rs#setup
Run cargo fuzzcheck <target>
Wait until it crashes
Verify the error by trying the output json yourself
Please make sure to follow https://matrix.org/security-disclosure-policy/ for found errors instead of posting them in public unless you are 100% sure they are not a security issue. If you are in doubt prefer the security disclosure policy.

Usage of afl.rs

Create a HS
Setup a user
Install afl.rs -> cargo install afl
Run cargo afl build
Set MATRIX_USERNAME and MATRIX_PASSWORD to the username and password of the user you want to fuzz as.
Run cargo afl fuzz -i ./afl/<target>/in -o ./afl/<target>/out ./target/debug/<target>
Wait until it crashes
Verification is a little harder. See rust-fuzz/afl.rs#215 on how to reproduce things
Please make sure to follow https://matrix.org/security-disclosure-policy/ for found errors instead of posting them in public unless you are 100% sure they are not a security issue. If you are in doubt prefer the security disclosure policy.

Hall of Explosions (Bugs found)

Known bugs in the fuzzer

The fuzzer generates arbitrary json objects currently very poorly. Resulting in a lot less cases than it should. Its a workaround for now until there is a nicer way.

Recommend Projects