Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
Impact
matrix-react-sdk before 3.102.0 allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite.
Patches
matrix-react-sdk 3.102.0 disables sharing message keys on invite by removing calls to the vulnerable functionality.
Workarounds
None.
References
The vulnerability in matrix-react-sdk is caused by calling MatrixClient.sendSharedHistoryKeys in matrix-js-sdk, which is inherently vulnerable to this sort of attack. This matrix-js-sdk vulnerability is tracked as CVE-2024-47080 / GHSA-4jf8-g8wp-cx7c. Given that this functionality is not specific to sharing message keys on invite, is optional, has to be explicitly called by the caller and has been independently patched in matrix-react-sdk by removing the offending calls, we believe it is proper to treat the matrix-react-sdk vulnerability as a separate one, with its own advisory and CVE.
The matrix-org/matrix-react-sdk repository has recently been archived and the project was moved to element-hq/matrix-react-sdk. Given that this happened after the first patched release, no releases of the project on element-hq/matrix-react-sdk were ever vulnerable to this vulnerability.
Patching pull request: https://github.com/matrix-org/matrix-react-sdk/pull/12618.
For more information
If you have any questions or comments about this advisory, please email us at security at security at matrix.org.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | matrix-react-sdk | >= 3.18.0, < 3.102.0 | 3.102.0 |
Referencias
- https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v
- https://nvd.nist.gov/vuln/detail/CVE-2024-47824
- https://github.com/matrix-org/matrix-react-sdk/pull/12618
- https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556
- https://github.com/matrix-org/matrix-react-sdk
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N- Debilidad (CWE)
CWE-200- Plataforma
- npm
- Paquete
matrix-react-sdk- Publicada
- 15.10.2024
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-qcvh-p9jq-wp8v - CC BY 4.0
Historial de vulnerabilidades: matrix-react-sdk
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 8
- Primera → última
- 03.2021 10.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 3
- Baja 1
Divulgaciones por año
- 2021: 2
- 2022: 0
- 2023: 4
- 2024: 2
- 2025: 0
- 2026: 0
-
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.