CVE-2024-47824: Matrix React SDK information disclosure on room invitation

CVE-2024-47824 · Severity: low · CVSS 3.1 · Published 2024-10-15

Matrix React SDK is a JavaScript library used by web-based chat applications (like Element) to implement end-to-end encryption and messaging. A malicious chat server can trick the application into sharing historical message decryption keys when a user invites another person to a room, allowing the server to decrypt previously protected messages. This undermines the confidentiality of encrypted conversations and could expose sensitive communication history.

Technologies: Matrix.org React SDK, matrix-react-sdk (npm). Vendors: Matrix.org, npm.

Quick answers

Is CVE-2024-47824 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-47824 being exploited in the wild.
How severe is CVE-2024-47824?
Low severity, with a CVSS score of 3.1, published 15 October 2024.
Which products and versions are affected?
Matrix.org React SDK 3.18.0 through 3.101.x; matrix-react-sdk (npm) SEMVER:introduced=3.18.0,fixed=3.102.0.
Is there a fix for CVE-2024-47824?
Yes. matrix-react-sdk (npm): upgrade to 3.102.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-47824 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-47824?
Check whether you run Matrix.org React SDK or matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-react-sdk (npm): upgrade to 3.102.0 or later
    npm install matrix-react-sdk@3.102.0

Technical details

The vulnerability is an information disclosure flaw (CWE-200) in matrix-react-sdk versions 3.18.0 through 3.101.x that occurs when a user invites another user to a room. The root cause is improper reuse of the MatrixClient.sendSharedHistoryKeys function, which was designed to share historical message keys but is inherently vulnerable to attack by a malicious homeserver. A malicious homeserver can inject specially crafted devices to intercept and capture these shared encryption keys. The attack requires network access to the homeserver and occurs automatically during the room invitation workflow—no additional user interaction is needed. An attacker can thus gain access to decrypt historical messages in the invited room. The vulnerability was patched in version 3.102.0 by removing calls to the vulnerable key-sharing functionality.

Affected products

  • Matrix.org React SDK 3.18.0 through 3.101.x

Identifiers

  • CVE-2024-47824
  • GHSA-qcvh-p9jq-wp8v

Timeline

  • 2024-10-15: disclosed
  • 2024-10-15: patched: Version 3.102.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.