High severity · published Oct 15, 2024
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
8.7
CVSS
0.7%
EPSS
No
On KEV
Description
matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by disabling sharing message keys on invite by removing calls to the vulnerable functionality. No known workarounds are available.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
matrix-react-sdk · matrix-org
>= 3.18.0, < 3.102.0 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47824
github.com
https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556
github.com
https://github.com/matrix-org/matrix-react-sdk/pull/12618
github.com
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v
More from matrix-react-sdk
8.2
CVE-2023-28103
Prototype pollution in matrix-react-sdk
6.5
CVE-2024-42347
URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
5.4
CVE-2023-37259
Cross site scripting in Export Chat feature
5.3
CVE-2022-36060
Prototype pollution in matrix-react-sdk
4.7
CVE-2023-30609
matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting