CVE-2024-50336: matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
Summary
matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver.
Details
The Matrix specification demands homeservers to perform validation of the server-name and media-id components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk fails to perform this validation.
Patches
Fixed in matrix-js-sdk 34.11.1.
Workarounds
None.
References
- https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5 - https://blog.doyensec.com/2024/07/02/cspt2csrf.html
Other sources
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
— NVD
The Matrix specification demands homeservers to perform validation of the server-name and media-id components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk fails to perform this validation.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/matrix-js-sdkto a version that resolves this vulnerability.Fixed in 34.11.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 134 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.5.2 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.6.0esr-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.5.2esr-1 - Upgrade
Upgrade
matrix-js-sdkto a version that resolves this vulnerability.Fixed in 34.11.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-50336?
CVE-2024-50336 has been classified as a moderate severity vulnerability due to the potential for client-side path traversal.
How do I fix CVE-2024-50336?
To fix CVE-2024-50336, upgrade the matrix-js-sdk to version 34.11.1 or later.
Who is affected by CVE-2024-50336?
Clients using matrix-js-sdk versions prior to 34.11.0 are affected by CVE-2024-50336.
What kind of impact does CVE-2024-50336 have?
CVE-2024-50336 allows a malicious room member to issue arbitrary authenticated GET requests to the client's homeserver.
Which software packages are affected by CVE-2024-50336?
CVE-2024-50336 affects matrix-js-sdk, Mozilla Thunderbird, and specific versions of these packages.