CVE-2024-42369
published 2024-08-20CVE-2024-42369: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.46%
36.7th percentile
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-matrix-js-sdk | — | — |
| matrix-org | matrix-js-sdk | < 34.3.1 | 34.3.1 |
| matrix-org | matrix-js-sdk | >= 0 < 34.3.1 | 34.3.1 |
| matrix | javascript_sdk | < 34.3.1 | 34.3.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.3MEDIUM
vendor_debian4.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
ghsa·2024-08-20
CVE-2024-42369 [MEDIUM] CWE-674 matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
### Impact
A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's `getRoomUpgradeHistory` function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug.
Even if the CVSS score would be 4.1 ([AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L&version=3.1)) we classify this as High severity issue.
### Patches
This was patched in matrix-js-sdk 34.3.1.
### Workarounds
Sanity check rooms before passing them to the matrix-js-sdk or avoid call
OSV
CVE-2024-42369: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript
osv·2024-08-20·CVSS 5.3
CVE-2024-42369 [MEDIUM] CVE-2024-42369: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
OSV
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
osv·2024-08-20
CVE-2024-42369 [MEDIUM] matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
### Impact
A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's `getRoomUpgradeHistory` function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug.
Even if the CVSS score would be 4.1 ([AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L&version=3.1)) we classify this as High severity issue.
### Patches
This was patched in matrix-js-sdk 34.3.1.
### Workarounds
Sanity check rooms before passing them to the matrix-js-sdk or avoid call
Debian
CVE-2024-42369: node-matrix-js-sdk - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A...
vendor_debian·2024·CVSS 4.1
CVE-2024-42369 [MEDIUM] CVE-2024-42369: node-matrix-js-sdk - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A...
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-20
Published