CVE-2024-47080
published 2024-10-15CVE-2024-47080: matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.68%
48.3th percentile
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. Note that this only affects clients running the SDK with the legacy crypto stack. Clients using the new Rust cryptography stack (i.e. those that call `MatrixClient.initRustCrypto()` instead of `MatrixClient.initCrypto()`) are unaffected by this vulnerability, because `MatrixClient.sendSharedHistoryKeys()` raises an exception in such environments. The vulnerability was fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality. As a workaround, remove use of affected functionality from clients.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-matrix-js-sdk | — | — |
| matrix-org | matrix-js-sdk | — | — |
| matrix-org | matrix-js-sdk | >= 9.11.0 < 34.8.0 | 34.8.0 |
| matrix-react-sdk_project | matrix-react-sdk | >= 3.18.0 < 3.102.0 | 3.102.0 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.7HIGH
osv8.7HIGH
vendor_debian8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
osv·2024-10-15·CVSS 8.7
CVE-2024-47824 [HIGH] Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
### Impact
matrix-react-sdk before 3.102.0 allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite.
### Patches
matrix-react-sdk 3.102.0 [disables sharing message keys on invite](https://github.com/matrix-org/matrix-react-sdk/pull/12618) by removing calls to the vulnerable functionality.
### Workarounds
None.
### References
The vulnerability in matrix-react-sdk is caused by calling `MatrixClient.sendSharedHistoryKeys` in matrix-js-sdk, which is inhere
GHSA
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
ghsa·2024-10-15·CVSS 8.7
CVE-2024-47824 [HIGH] CWE-200 Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
### Impact
matrix-react-sdk before 3.102.0 allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite.
### Patches
matrix-react-sdk 3.102.0 [disables sharing message keys on invite](https://github.com/matrix-org/matrix-react-sdk/pull/12618) by removing calls to the vulnerable functionality.
### Workarounds
None.
### References
The vulnerability in matrix-react-sdk is caused by calling `MatrixClient.sendSharedHistoryKeys` in matrix-js-sdk, which is inhere
OSV
CVE-2024-47080: matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript
osv·2024-10-15·CVSS 8.7
CVE-2024-47080 [HIGH] CVE-2024-47080: matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. Note that this only affects clients runni
OSV
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
osv·2024-10-15
CVE-2024-47080 [HIGH] Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
### Impact
In matrix-js-sdk versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method implements functionality proposed in [MSC3061](https://github.com/matrix-org/matrix-spec-proposals/pull/3061) and can be used by clients to share historical message keys with newly invited users, granting them access to past messages in the room.
However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive s
GHSA
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
ghsa·2024-10-15
CVE-2024-47080 [HIGH] CWE-200 Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
### Impact
In matrix-js-sdk versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method implements functionality proposed in [MSC3061](https://github.com/matrix-org/matrix-spec-proposals/pull/3061) and can be used by clients to share historical message keys with newly invited users, granting them access to past messages in the room.
However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive s
Debian
CVE-2024-47080: node-matrix-js-sdk - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In ...
vendor_debian·2024·CVSS 8.7
CVE-2024-47080 [HIGH] CVE-2024-47080: node-matrix-js-sdk - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In ...
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. Note that this only affects clients runni
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-15
Published