t2bot matrix-media-repo up to 1.3.4 improper authentication

Summaryinfo

A vulnerability marked as critical has been reported in t2bot matrix-media-repo up to 1.3.4. This vulnerability affects unknown code. The manipulation leads to improper authentication. This vulnerability is listed as CVE-2024-36402. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in t2bot matrix-media-repo up to 1.3.4 and classified as critical. This issue affects an unknown code. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is availability. The summary by CVE is:

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-36402 since 05/27/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214906 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0297-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.3.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214906). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• t2bot

Name

• matrix-media-repo

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4

Website

• Product: https://github.com/t2bot/matrix-media-repo/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion