PT-2024-7389 · Unknown+1 · Matrix-Js-Sdk+1

Dkasak · Published 2024-09-17 · Updated 2024-12-16 · CVE-2024-47080

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions 9.11.0 through 34.7.0

Description: The issue is related to the MatrixClient.sendSharedHistoryKeys method in the matrix-js-sdk, which is vulnerable to interception by malicious homeservers. This method is used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows an attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. The vulnerability only affects clients running the SDK with the legacy crypto stack.

Recommendations: For matrix-js-sdk versions 9.11.0 through 34.7.0, update to version 34.8.0, which removes the vulnerable functionality. As a temporary workaround, consider removing the use of the affected MatrixClient.sendSharedHistoryKeys method from clients. Restrict access to the MatrixClient.sendSharedHistoryKeys method to minimize the risk of exploitation, especially in environments where the legacy crypto stack is used.

Exploit

Fix

Information Disclosure

Improper Authentication

Weakness Enumeration

CWE-200

CWE-287

Related Identifiers

BDU:2024-08758

CVE-2024-47080

GHSA-4JF8-G8WP-CX7C

Affected Products

Debian

Matrix-Js-Sdk

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47080.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47080 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jf8-g8wp-cx7c · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47080 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47080 · Security Note
• https://bdu.fstec.ru/vul/2024-08758 · Security Note
• https://ubuntu.com/security/CVE-2024-47080 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47080 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47080 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47080 · Vendor Advisory
• https://github.com/matrix-org/matrix-js-sdk · Note
• https://github.com/matrix-org/matrix-js-sdk/commit/2fb1e659c81f75253c047832dc9dcc2beddfac5f · Note
• https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-4jf8-g8wp-cx7c · Note
• https://github.com/matrix-org/matrix-spec-proposals/pull/3061 · Note
• https://twitter.com/VulmonFeeds/status/1846255406827421851 · Twitter Post