Executive brief
matrix-js-sdk is a JavaScript library used by Matrix chat applications to manage rooms and user interactions. A malicious Matrix server can craft a room configuration that creates a cycle in the room predecessor chain, causing the library's room upgrade history function to infinitely loop and freeze the application. This affects any user attempting to leave such a room or query its upgrade history, disrupting service availability.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) in the getRoomUpgradeHistory function, which traverses a room's predecessor chain without cycle detection. A malicious homeserver can create a room structure where a room references itself as its own predecessor, causing infinite recursion and application hang. The leaveRoomChain method internally calls getRoomUpgradeHistory, so leaving a room can trigger the bug. Exploitation requires a malicious homeserver and user interaction (viewing/leaving the crafted room). The vulnerability was patched in matrix-js-sdk version 34.3.1.
Affected products
- matrix-org matrix-js-sdk <34.3.1
Timeline
- 2024-08-20: disclosed
- 2024-08-20: patched: matrix-js-sdk 34.3.1