CVE-2024-50336

What it actually does

Client-side path traversal via crafted MXC URIs in matrix-js-sdk before 34.11.0 causes the client to issue arbitrary authenticated GET requests to the homeserver.

Why it matters to the business

Attackers sharing a Matrix room can force vulnerable clients to retrieve arbitrary server data using the client's credentials, enabling unauthorized access and potential lateral movement without direct server compromise.

How an attack unfolds

A malicious room member embeds a crafted MXC URI in a message; the victim's matrix-js-sdk client parses the URI and performs an authenticated GET request to an attacker-chosen homeserver path.

How to fix it

Upgrade matrix-js-sdk to version 34.11.1 or later (commit b4c4355d1a34dd3e4b22467f556eebe368768ea5).

How to confirm the fix worked

Confirm matrix-js-sdk version is 34.11.1 or newer; test that crafted MXC URIs no longer result in requests to arbitrary paths.

Typical attack path

1. Join the same Matrix room as the target client
2. Send a message containing a crafted MXC URI
3. Victim client processes the URI and issues the authenticated request
4. Attacker receives or observes the results of the unauthorized fetch

How to detect it

Review client application logs and network traffic for authenticated GET requests to homeserver paths that originate from MXC URI processing in room events.

What your security team should do

• Immediately update all deployments of matrix-js-sdk to the fixed version
• Audit Matrix room memberships and remove untrusted participants from sensitive rooms
• Monitor client logs for unexpected authenticated GET requests to non-standard homeserver paths