CVE-2024-42347

Executive Summary

CVE-2024-42347 is a vulnerability in the matrix-react-sdk, a React-based SDK used to embed Matrix chat/voip clients into web pages. The flaw allows a malicious homeserver to manipulate a user's account data, enabling URL previews in end-to-end encrypted rooms. This causes any URLs present in encrypted messages to be sent to the server, breaking the confidentiality of end-to-end encryption. The vulnerability has a CVSS score of 7.7 (High) and affects versions prior to 3.105.0. Deployments that trust their homeservers or operate within closed federations of trusted servers are not affected. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability affects the matrix-react-sdk package, which is distributed via npm. Organizations using this SDK should verify their dependency tree to ensure they are not using a vulnerable version. The package is a critical component for building Matrix clients, and its compromise could lead to widespread data leakage in encrypted communications. Supply chain security measures, such as dependency scanning and integrity verification, are essential to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the potential for unauthorized disclosure of sensitive information from encrypted communications. The attack requires user interaction (e.g., clicking a link) but can be executed by a malicious homeserver without prior authentication.

Deep Dive & Mechanics

The vulnerability resides in the matrix-react-sdk's handling of user account data. A malicious homeserver can manipulate the m.accepted_terms or similar account data fields to enable URL previews in end-to-end encrypted rooms. When URL previews are enabled, the client sends URLs from encrypted messages to the server for preview generation, thereby leaking the content of encrypted communications.

The root cause is insufficient validation of account data modifications by the homeserver. The SDK trusts the homeserver to provide accurate account data, but a malicious homeserver can inject false data to enable features that compromise encryption.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.105.0): The SDK likely reads account data without verifying its integrity or origin, allowing a malicious homeserver to set url_previews_enabled or similar flags.

// Vulnerable: Directly trusts homeserver account data
const accountData = await client.getAccountData('m.accepted_terms');
if (accountData.url_previews_enabled) {
    enableUrlPreviews();
}

Patched Code (3.105.0): The patched version likely validates that account data changes are authorized and that URL previews are only enabled in non-encrypted rooms or with explicit user consent.

// Patched: Validates account data and restricts URL previews
const accountData = await client.getAccountData('m.accepted_terms');
if (accountData.url_previews_enabled && !room.isEncrypted()) {
    enableUrlPreviews();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a malicious homeserver (or ability to simulate one).
• A target user running a vulnerable version of matrix-react-sdk (< 3.105.0).

Exploitation Steps:

1. Set up a malicious Matrix homeserver (e.g., using Synapse with modified code).
2. As the homeserver, manipulate the target user's account data to set url_previews_enabled: true.
3. Send an encrypted message containing a URL to the target user.
4. The vulnerable client will send the URL to the homeserver for preview, leaking the encrypted content.

Lab Setup:

• Use Docker to deploy a vulnerable Matrix client (e.g., Element Web with an older SDK).
• Configure the client to connect to a controlled malicious homeserver.
• Monitor network traffic to observe the URL leakage.

Blue Team

Detection:

• Monitor for unexpected changes to user account data, especially url_previews_enabled flags.
• Alert on outbound requests from Matrix clients to homeservers for URL previews in encrypted rooms.
• Use network monitoring to detect unusual patterns of URL preview requests.

Mitigation:

• Upgrade to matrix-react-sdk version 3.105.0 or later.
• Restrict homeserver trust to known, verified servers.
• Disable URL previews globally in encrypted rooms via client configuration.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from Matrix clients to homeservers containing URLs from encrypted rooms.
• Logs: Account data modification events for m.accepted_terms or similar fields with unexpected values.
• File: Presence of url_previews_enabled: true in client account data for encrypted rooms.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_Matrix_SDK {
    meta:
        description = "Detects vulnerable matrix-react-sdk versions (< 3.105.0)"
        author = "Valters IT"
        date = "2024-01-01"
        hash = "unknown"
    strings:
        $sdk_version = /matrix-react-sdk@[0-2]\.\d+\.\d+|3\.(0[0-9][0-9]|1[0-4][0-9]|10[0-4])\.\d+/
    condition:
        $sdk_version
}

Sigma Rule

title: Matrix URL Preview in Encrypted Room
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects URL preview requests from encrypted Matrix rooms
logsource:
    category: network
    product: proxy
detection:
    selection:
        url|contains: "/_matrix/media/v3/preview_url"
        referer|contains: "matrix"
    condition: selection
falsepositives:
    - Legitimate URL previews in non-encrypted rooms
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Matrix URL Preview in Encrypted Room";
    flow:to_server,established;
    content:"/_matrix/media/v3/preview_url"; http_uri;
    reference:cve,2024-42347;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade matrix-react-sdk to version 3.105.0 or later.
2. Verify that all Matrix clients in the environment are using the patched version.
3. Review and restrict homeserver trust relationships.

Long-term Measures:

• Implement strict validation of account data modifications by homeservers.
• Disable URL previews in encrypted rooms by default.
• Conduct regular security audits of SDK dependencies.

Workarounds:

• No known workarounds exist; upgrading is the only effective mitigation.

Valters IT