CVE-2024-42369 A room with itself as a its predecessor will freeze matrix-js-sdk
A malicious homeserver can cause the Matrix JavaScript SDK to hang via infinite recursion when processing cyclic room structures, requiring an upgrade.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-42369?
CVE-2024-42369 is a medium-severity denial of service vulnerability in matrix-org matrix-js-sdk, published on 20 Aug 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.
Weakness: CWE-674
Which versions are affected by CVE-2024-42369?
2 open source packages ship an affected version, including matrix-js-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-js-sdk npm | All versions | 34.3.1 |
matrix-js-sdk npm | All versions | 34.3.1 |
Linux distribution packages (2)
element-desktop openSUSE:Tumbleweed | All versions | 1.11.75-1.1 |
element-web openSUSE:Tumbleweed | All versions | 1.11.75-1.1 |
Products include Matrix Javascript Sdk.
How do I fix CVE-2024-42369?
Upgrade matrix-js-sdk to 34.3.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-42369 being exploited?
There is no known exploitation of CVE-2024-42369 in the wild and no public exploit code.
Other vulnerabilities in matrix-org matrix-js-sdk
- CVE-2022-39250 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
- CVE-2022-39251 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
- CVE-2022-36059 Prototype pollution in matrix-js-sdk
- CVE-2023-28427 Prototype pollution in matrix-js-sdk
- CVE-2022-39249 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Sources
Also known as DEBIAN-CVE-2024-42369, GHSA-vhr5-g3pm-49fm, UBUNTU-CVE-2024-42369, openSUSE-SU-2024:14288-1, openSUSE-SU-2024:14289-1.