CVE-2024-52594 Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib
An attacker can exploit Server-Side Request Forgery in gomatrixserverlib to access private network resources via redirects or federation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52594?
CVE-2024-52594 is a medium-severity server-side request forgery vulnerability in matrix-org gomatrixserverlib, published on 16 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.
Weakness: CWE-918
Which versions are affected by CVE-2024-52594?
3 open source packages ship an affected version, including github.com/matrix-org/gomatrixserverlib.
| Package | Affected | Fixed in |
|---|---|---|
github.com/matrix-org/gomatrixserverlib Go | All versions | 0.0.0-20250116181547-c4f1e01eab0d |
github.com/matrix-org/gomatrixserverlib Go | All versions | 0.0.0-20250116181547-c4f1e01eab0d |
github.com/matrix-org/gomatrixserverlib Go | All versions | 0.0.0-20250116181547-c4f1e01eab0d |
How do I fix CVE-2024-52594?
Upgrade github.com/matrix-org/gomatrixserverlib to 0.0.0-20250116181547-c4f1e01eab0d or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-52594 being exploited?
There is no known exploitation of CVE-2024-52594 in the wild and no public exploit code.
Sources
Also known as GHSA-4ff6-858j-r822, GO-2025-3396.