CVE-2024-42369

EUVD-2024-2665

20.08.2024, 15:15

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug. This was patched in matrix-js-sdk 34.3.1.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.1 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 39.71%

Affected Products (NVD)

Vendor	Product	Version
matrix	javascript_sdk	𝑥 < 34.3.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

node-matrix-js-sdk

bullseye

vulnerable

Ubuntu Releases

Ubuntu Product

Codename

node-matrix-js-sdk

focal	ignored
jammy	needs-triage
noble	needs-triage
oracular	ignored
plucky	dne
questing	dne
resolute	dne

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6

https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm