Is CVE-2024-47080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-47080 being exploited in the wild.

How severe is CVE-2024-47080?

Medium severity, with a CVSS score of 4, published 15 October 2024.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=9.11.0,fixed=34.8.0.

Is there a fix for CVE-2024-47080?

Yes. matrix-js-sdk (npm): upgrade to 34.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-47080 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-47080?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-47080: Matrix JavaScript SDK key history sharing vulnerability

CVE-2024-47080 · Severity: medium · CVSS 4 · Published 2024-10-15

The Matrix JavaScript SDK is a library used by chat applications to communicate with Matrix homeservers and manage encrypted messaging. A vulnerability in the sendSharedHistoryKeys feature allows malicious homeservers to intercept and receive historical message keys intended for invited users, giving attackers access to past messages without proper identity verification. Only applications using the legacy cryptography stack are affected; those using the newer Rust cryptography stack are protected.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2024-47080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-47080 being exploited in the wild.
How severe is CVE-2024-47080?: Medium severity, with a CVSS score of 4, published 15 October 2024.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=9.11.0,fixed=34.8.0.
Is there a fix for CVE-2024-47080?: Yes. matrix-js-sdk (npm): upgrade to 34.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-47080 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-47080?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 34.8.0 or later
```
npm install matrix-js-sdk@34.8.0
```

Technical details

The vulnerability exists in the MatrixClient.sendSharedHistoryKeys method, which implements MSC3061 functionality to share historical message keys with newly invited users. The method fails to verify the cryptographic identity of invited devices before sending keys, allowing a malicious homeserver to inject its own fake devices into the invited user's device list to receive sensitive key material. The vulnerability is rooted in insufficient authentication (CWE-287) and exposure of sensitive information (CWE-200). Attack requires a compromised homeserver but no user interaction; the network-based attack exposes encryption keys without authentication checks. The vulnerability only affects the legacy crypto stack; clients using MatrixClient.initRustCrypto() instead of MatrixClient.initCrypto() raise an exception and are unaffected. The fix removes the vulnerable sendSharedHistoryKeys functionality entirely in version 34.8.0.

Affected products

matrix-org matrix-js-sdk 9.11.0 through 34.7.0

Identifiers

CVE-2024-47080
GHSA-4jf8-g8wp-cx7c

Timeline

2024-10-15: disclosed
2024-10-15: patched: Fixed in version 34.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.