Executive brief
matrix-js-sdk is a JavaScript library used by Matrix chat clients to communicate with homeservers. The library fails to properly validate MXC (Matrix Content) URIs, allowing malicious room members to craft special URIs that trigger clients to make unauthorized authenticated requests to the user's homeserver, potentially exposing sensitive data or triggering unintended actions on the user's account.
Technical details
The vulnerability is a client-side path traversal issue in matrix-js-sdk's MXC URI handling (CWE-22). While the Matrix specification requires homeservers to validate the server-name and media-id components of MXC URIs, the client-side validation is insufficient, allowing crafted MXC URIs to bypass path traversal protections. An attacker with room membership can send malicious MXC URIs in messages; when processed by vulnerable clients, these URIs cause the client to issue arbitrary authenticated GET requests to the homeserver with the victim's credentials. The attack requires the attacker to be a room member (low privileges) but no user interaction. The vulnerability was fixed in matrix-js-sdk version 34.11.1.
Affected products
- Matrix.org matrix-js-sdk before 34.11.1
Timeline
- 2024-11-12: disclosed
- 2024-11-12: patched: Fixed in version 34.11.1