Quick answers
- Is CVE-2024-42347 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-42347 being exploited in the wild.
- How severe is CVE-2024-42347?
- Low severity, with a CVSS score of 3.1, published 6 August 2024.
- Which products and versions are affected?
- matrix-react-sdk (npm) SEMVER:introduced=0,fixed=3.105.1.
- Is there a fix for CVE-2024-42347?
- Yes. matrix-react-sdk (npm): upgrade to 3.105.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-42347 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-42347?
- Check whether you run matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- matrix-react-sdk (npm): upgrade to 3.105.1 or later
npm install matrix-react-sdk@3.105.1
Technical details
The vulnerability exists in how matrix-react-sdk handles the URL preview setting for rooms. A malicious or compromised homeserver can modify a user's account data to enable URL previews in end-to-end encrypted rooms without the user's consent or awareness. When URL previews are enabled, any URLs contained in encrypted messages are sent to the homeserver to generate previews, leaking metadata that should remain protected by encryption. The attack requires a malicious or compromised homeserver (high privilege), but no user interaction. The issue was patched in version 3.105.1 by restricting the homeserver's ability to control this security-critical setting.
Affected products
- The Matrix.org Foundation matrix-react-sdk <3.105.1
Identifiers
- CVE-2024-42347
- GHSA-f83w-wqhc-cfp4
Timeline
- 2024-08-06: disclosed: CVE-2024-42347 published
- 2024-08-06: patched: Fix released in version 3.105.1