matrix-org matrix-js-sdk up to 34.11.0 on JavaScript MXC URI path traversal

Summaryinfo

A vulnerability was found in matrix-org matrix-js-sdk up to 34.11.0 on JavaScript. It has been rated as critical. The affected element is an unknown function of the component MXC URI Handler. The manipulation leads to path traversal. This vulnerability is documented as CVE-2024-50336. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in matrix-org matrix-js-sdk up to 34.11.0 on JavaScript and classified as critical. This issue affects an unknown function of the component MXC URI Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity. The summary by CVE is:

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-50336 since 10/22/2024. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 212420 (Mozilla Thunderbird < 128.5.2), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 34.11.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (212420). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• matrix-org

Name

• matrix-js-sdk

Version

• 34.0
• 34.1
• 34.2
• 34.3
• 34.4
• 34.5
• 34.6
• 34.7
• 34.8
• 34.9
• 34.10
• 34.11.0

Website

• Product: https://github.com/matrix-org/matrix-js-sdk/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion