CVE-2024-36402

Executive Summary

CVE-2024-36402 affects Matrix Media Repo (MMR), a multi-homeserver media repository for the Matrix communication protocol. The vulnerability allows unauthenticated remote attackers to trigger the download and caching of arbitrary remote media into the local MMR instance. Once cached, this content becomes available for download by any unauthenticated user, effectively enabling adversaries to plant malicious or policy-violating content (e.g., CSAM, malware, propaganda) into the repository. The attack vector is inherent to the design of MMR’s unauthenticated media download endpoints.

The CVSS score is 5.3 (Medium), reflecting the low complexity and network-based attack vector, but the impact is limited to integrity and availability of stored media. No public exploit code or PoC is available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. The vendor has released version 1.3.5 with a partial mitigation: new authenticated endpoints for media downloads. The unauthenticated endpoints will be frozen in a future release.

Supply Chain & Package Security

Matrix Media Repo is a Go-based application distributed as a Docker image and source code. The vulnerability is not in a dependency but in the application’s own API design. However, operators should verify the integrity of the MMR binary or container image (e.g., via checksums or signed releases) before upgrading. No malicious packages have been reported in the supply chain.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (media metadata may be exposed).
• Integrity (I): Low (L) – Attacker can plant arbitrary content.
• Availability (A): None (N) – No direct denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires the attacker to have a remote homeserver to serve malicious media. The primary risk is content poisoning, which could lead to legal or reputational damage for the server operator.

Deep Dive & Mechanics

Matrix Media Repo acts as a caching proxy for media shared across Matrix homeservers. When a user on a remote homeserver requests media from a local user, MMR fetches and caches it. The vulnerability lies in the unauthenticated media download endpoints (e.g., /_matrix/media/v1/download/...). By design, any unauthenticated client can request a URL pointing to a remote homeserver’s media, and MMR will download and cache it locally. The cached content is then served to any unauthenticated requester.

Attack Flow:

1. Attacker sets up a malicious homeserver (or uses a compromised one) hosting a file (e.g., malicious.exe or illegal_image.jpg).
2. Attacker sends a crafted HTTP request to the target MMR instance:
   GET /_matrix/media/v1/download/attacker-server/file_id
3. MMR fetches the file from the attacker’s server, caches it locally, and returns it to the attacker.
4. The file is now stored in the local MMR repository and can be downloaded by anyone without authentication via the same endpoint.

The vulnerability is not a code injection or memory corruption; it is a design flaw in the API’s access control. The patch in v1.3.5 introduces new authenticated endpoints (e.g., /_matrix/media/v1/download/... with authentication) and deprecates the unauthenticated ones.

Vulnerable vs. Patched Code

Vulnerable (pre-1.3.5):
The download handler does not check for authentication before fetching remote media. Example pseudocode:

func handleDownload(w http.ResponseWriter, r *http.Request) {
    // No auth check
    remoteURL := extractRemoteURL(r)
    media := fetchAndCache(remoteURL)
    w.Write(media)
}

Patched (1.3.5+):
The handler now requires a valid access token for new endpoints. The old endpoints are deprecated and will be removed.

func handleDownloadAuthenticated(w http.ResponseWriter, r *http.Request) {
    token := r.Header.Get("Authorization")
    if !validateToken(token) {
        http.Error(w, "Unauthorized", 401)
        return
    }
    remoteURL := extractRemoteURL(r)
    media := fetchAndCache(remoteURL)
    w.Write(media)
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target MMR instance running version < 1.3.5.
• A remote HTTP server (e.g., attacker-controlled) serving a file.

Steps:

1. Host a test file on your server:
   echo "malicious content" > /var/www/html/test.txt
2. Send a request to the target MMR:

   curl -v "http://target-mmr:8000/_matrix/media/v1/download/your-server.com/test.txt"
   

3. Verify the file is cached and accessible:

   curl "http://target-mmr:8000/_matrix/media/v1/download/your-server.com/test.txt"
   

   The response should contain the malicious content.

Note: No public exploit code is available. This is a simple API abuse.

Blue Team (Detection & Hardening)

Detection:

• Monitor logs for repeated requests to /_matrix/media/v1/download/ from unknown IPs.
• Look for requests where the server parameter points to an external, untrusted homeserver.
• Use rate limiting on unauthenticated endpoints (workaround).

Hardening:

• Upgrade to MMR 1.3.5 or later.
• If upgrade is not possible, implement strict rate limiting per IP on the unauthenticated download endpoints.
• Restrict outbound connections from MMR to only known, trusted homeservers (if feasible).
• Monitor for unusual media files (e.g., executable binaries, large files) in the repository.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /_matrix/media/v1/download/ with external server names not in the trusted list.
  • Outbound connections from MMR to unknown IPs/domains on port 443 or 80.
• File IOCs:
  • Unexpected files in the MMR cache directory (e.g., .exe, .zip, .jpg with anomalous metadata).
  • Files with hashes matching known malicious content (e.g., from threat intel feeds).
• Log IOCs:
  • Repeated 200 responses for /_matrix/media/v1/download/ from the same IP in a short time.
  • Errors like failed to fetch remote media from unknown servers.

Detection Engineering

YARA Rule

rule CVE_2024_36402_MMR_Unauth_Download {
    meta:
        description = "Detects attempts to exploit CVE-2024-36402 in Matrix Media Repo logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-36402"
    strings:
        $s1 = "/_matrix/media/v1/download/" ascii wide nocase
        $s2 = "GET" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-36402 - Unauthenticated Media Download in Matrix Media Repo
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the unauthenticated media download endpoint of Matrix Media Repo.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36402
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/_matrix/media/v1/download/'
    condition: selection
falsepositives:
    - Legitimate media downloads from trusted homeservers (if authentication is not enforced)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36402 - Unauthenticated MMR Media Download"; flow:to_server; content:"GET"; http_method; content:"/_matrix/media/v1/download/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Matrix Media Repo version 1.3.5 or later.
• If upgrade is not possible, implement strict rate limiting on the unauthenticated download endpoints (e.g., 10 requests per minute per IP).
• Restrict outbound connections from MMR to only known, trusted homeservers using a firewall or proxy.

Long-term:

• Monitor the MMR project for the final removal of unauthenticated endpoints.
• Implement additional authentication mechanisms (e.g., OAuth2) for all media operations.
• Regularly audit cached media for policy violations.

Workaround:
Use a reverse proxy (e.g., Nginx) to block requests to /_matrix/media/v1/download/ unless they come from authenticated users (e.g., via a token in a header).

Valters IT
DevSecOps & Cyber Threat Intelligence