Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2024-50336: matrix-js-sdk can be tricked into unauthorized server requests
CVE-2024-50336 · published 1 year ago
Summary
The JavaScript library used by Matrix chat clients, including Thunderbird on Debian, may let a malicious participant cause the client to send unexpected requests to its own server. This could expose data or allow actions without the user’s consent. Update the library to version 34.11.1 or later to stop the problem.
What to do
- Update GitHub Actions matrix-js-sdk to version 34.11.1.
- Update debian thunderbird to version 1:128.6.0esr-1~deb12u1.
- Update debian thunderbird to version 1:128.5.2esr-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | matrix-js-sdk |
< 34.11.1 Fix: upgrade to 34.11.1
|
| Debian:12 | debian | thunderbird |
< 1:128.6.0esr-1~deb12u1 Fix: upgrade to 1:128.6.0esr-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:128.5.2esr-1 Fix: upgrade to 1:128.5.2esr-1
|
Original advisory text
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
References
- https://github.com/advisories/GHSA-xvg8-m4x3-w6xr
- https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html URL
- https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50336... Vendor Advisory
- https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2024-50336 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-50336 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-22Path Traversal
Timeline
Published12 Nov 2024
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-xvg8-m4x3-w6xr · GHSA
CVE-2024-50336 · NVD
CVE-2024-50336 · OSV
DEBIAN-CVE-2024-50336 · OSV
Track software like this
Free during beta