Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS00amY4LWc4d3AtY3g3Y84ABARf

Matrix JavaScript SDK's key history sharing could share keys to malicious devices

Impact

In matrix-js-sdk versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method implements functionality proposed in MSC3061 and can be used by clients to share historical message keys with newly invited users, granting them access to past messages in the room.

However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks.

Note that this only affects clients running the SDK with the legacy crypto stack. Clients using the new Rust cryptography stack (i.e. those that call MatrixClient.initRustCrypto() instead of MatrixClient.initCrypto()) are unaffected by this vulnerability, because MatrixClient.sendSharedHistoryKeys() raises an exception in such environments.

Patches

Fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality.

Workarounds

Remove use of affected functionality from clients.

References

For more information

If you have any questions or comments about this advisory, please email us at security at matrix.org.

Permalink: https://github.com/advisories/GHSA-4jf8-g8wp-cx7c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00amY4LWc4d3AtY3g3Y84ABARf
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 6 hours ago
Updated: about 6 hours ago


Identifiers: GHSA-4jf8-g8wp-cx7c, CVE-2024-47080
References: Repository: https://github.com/matrix-org/matrix-js-sdk
Blast Radius: 0.0

Affected Packages

npm:matrix-js-sdk
Dependent packages: 94
Dependent repositories: 1,037
Downloads: 89,596 last month
Affected Version Ranges: >= 9.11.0, < 34.8.0
Fixed in: 34.8.0
All affected versions: 9.11.0, 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.2.0, 12.0.0, 12.0.1, 12.1.0, 12.2.0, 12.3.0, 12.3.1, 12.4.0, 12.4.1, 12.5.0, 13.0.0, 14.0.0, 14.0.1, 15.0.0, 15.1.0, 15.1.1, 15.2.0, 15.2.1, 15.3.0, 15.4.0, 15.5.0, 15.5.1, 15.5.2, 15.6.0, 16.0.0, 16.0.1, 17.0.0, 17.1.0, 17.2.0, 18.0.0, 18.1.0, 19.0.0, 19.1.0, 19.2.0, 19.3.0, 19.4.0, 19.5.0, 19.6.0, 19.7.0, 20.0.0, 20.0.1, 20.0.2, 20.1.0, 21.0.0, 21.0.1, 21.1.0, 21.2.0, 22.0.0, 23.0.0, 23.1.0, 23.1.1, 23.2.0, 23.3.0, 23.4.0, 23.5.0, 24.0.0, 24.1.0, 25.0.0, 25.1.0, 25.1.1, 26.0.0, 26.0.1, 26.1.0, 26.2.0, 27.0.0, 27.1.0, 27.2.0, 28.0.0, 28.1.0, 28.2.0, 29.0.0, 29.1.0, 30.0.0, 30.0.1, 30.1.0, 30.2.0, 30.3.0, 31.0.0, 31.1.0, 31.2.0, 31.3.0, 31.4.0, 31.5.0, 31.6.0, 31.6.1, 32.0.0, 32.1.0, 32.2.0, 32.3.0, 32.4.0, 33.0.0, 33.1.0, 34.0.0, 34.1.0, 34.2.0, 34.3.0, 34.3.1, 34.4.0, 34.5.0, 34.6.0, 34.7.0
All unaffected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.7.9, 0.7.10, 0.7.11, 0.7.12, 0.7.13, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.9.0, 0.9.1, 0.9.2, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.10.8, 0.10.9, 0.11.0, 0.11.1, 0.12.0, 0.12.1, 0.13.0, 0.13.1, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.2.0, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 3.0.0, 4.0.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.2.2, 7.0.0, 7.1.0, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.1, 8.5.0, 9.0.0, 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.4.1, 9.5.0, 9.5.1, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, 34.8.0