CVE-2024-42369: matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

August 20, 2024

A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk’s getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the ’leaveRoomChain()’ method, so leaving a room will also trigger the bug.

References

github.com/advisories/GHSA-vhr5-g3pm-49fm
github.com/matrix-org/matrix-js-sdk
github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6
github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm
nvd.nist.gov/vuln/detail/CVE-2024-42369

Code Behaviors & Features

Detect and mitigate CVE-2024-42369 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →