Is CVE-2024-42369 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-42369 being exploited in the wild.

How severe is CVE-2024-42369?

Low severity, with a CVSS score of 3.1, published 20 August 2024.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=34.3.1.

Is there a fix for CVE-2024-42369?

Yes. matrix-js-sdk (npm): upgrade to 34.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-42369 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-42369?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-42369: matrix-js-sdk infinite recursion in room upgrade history

CVE-2024-42369 · Severity: low · CVSS 3.1 · Published 2024-08-20

matrix-js-sdk is a JavaScript library used by Matrix chat applications to manage rooms and user interactions. A malicious Matrix server can craft a room configuration that creates a cycle in the room predecessor chain, causing the library's room upgrade history function to infinitely loop and freeze the application. This affects any user attempting to leave such a room or query its upgrade history, disrupting service availability.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2024-42369 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-42369 being exploited in the wild.
How severe is CVE-2024-42369?: Low severity, with a CVSS score of 3.1, published 20 August 2024.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=34.3.1.
Is there a fix for CVE-2024-42369?: Yes. matrix-js-sdk (npm): upgrade to 34.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-42369 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-42369?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 34.3.1 or later
```
npm install matrix-js-sdk@34.3.1
```

Technical details

The vulnerability is an uncontrolled recursion (CWE-674) in the getRoomUpgradeHistory function, which traverses a room's predecessor chain without cycle detection. A malicious homeserver can create a room structure where a room references itself as its own predecessor, causing infinite recursion and application hang. The leaveRoomChain method internally calls getRoomUpgradeHistory, so leaving a room can trigger the bug. Exploitation requires a malicious homeserver and user interaction (viewing/leaving the crafted room). The vulnerability was patched in matrix-js-sdk version 34.3.1.

Affected products

matrix-org matrix-js-sdk <34.3.1

Identifiers

CVE-2024-42369
GHSA-vhr5-g3pm-49fm

Timeline

2024-08-20: disclosed
2024-08-20: patched: matrix-js-sdk 34.3.1

References

https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.