Is CVE-2024-50336 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-50336 being exploited in the wild.

How severe is CVE-2024-50336?

Medium severity, with a CVSS score of 4, published 12 November 2024.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=34.11.1.

Is there a fix for CVE-2024-50336?

Yes. matrix-js-sdk (npm): upgrade to 34.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-50336 attacked?

It is attacked over the network.

Am I affected by CVE-2024-50336?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-50336: matrix-js-sdk MXC URI path traversal

CVE-2024-50336 · Severity: medium · CVSS 4 · Published 2024-11-12

matrix-js-sdk is a JavaScript library used by Matrix chat clients to communicate with homeservers. The library fails to properly validate MXC (Matrix Content) URIs, allowing malicious room members to craft special URIs that trigger clients to make unauthorized authenticated requests to the user's homeserver, potentially exposing sensitive data or triggering unintended actions on the user's account.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2024-50336 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-50336 being exploited in the wild.
How severe is CVE-2024-50336?: Medium severity, with a CVSS score of 4, published 12 November 2024.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=34.11.1.
Is there a fix for CVE-2024-50336?: Yes. matrix-js-sdk (npm): upgrade to 34.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-50336 attacked?: It is attacked over the network.
Am I affected by CVE-2024-50336?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 34.11.1 or later
```
npm install matrix-js-sdk@34.11.1
```

Technical details

The vulnerability is a client-side path traversal issue in matrix-js-sdk's MXC URI handling (CWE-22). While the Matrix specification requires homeservers to validate the server-name and media-id components of MXC URIs, the client-side validation is insufficient, allowing crafted MXC URIs to bypass path traversal protections. An attacker with room membership can send malicious MXC URIs in messages; when processed by vulnerable clients, these URIs cause the client to issue arbitrary authenticated GET requests to the homeserver with the victim's credentials. The attack requires the attacker to be a room member (low privileges) but no user interaction. The vulnerability was fixed in matrix-js-sdk version 34.11.1.

Affected products

Matrix.org matrix-js-sdk before 34.11.1

Identifiers

CVE-2024-50336
GHSA-xvg8-m4x3-w6xr

Timeline

2024-11-12: disclosed
2024-11-12: patched: Fixed in version 34.11.1

References

https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.