CVE-2024-56515

Executive Summary

CVE-2024-56515 is a type confusion vulnerability in Matrix Media Repo (MMR), a highly configurable multi-homeserver media repository for the Matrix communication protocol. The vulnerability arises when SVG, JPEGXL, or MP4 thumbnailers are enabled (disabled by default). An attacker can upload a file claiming to be one of these types and request a thumbnail, causing MMR to invoke a different decoder in ImageMagick or ffmpeg. In some ImageMagick installations, this includes the ability to run Ghostscript to decode the file, potentially leading to arbitrary code execution. The vulnerability is fixed in MMR v1.3.8, which now inspects the actual mimetype of media prior to thumbnailing.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Matrix Media Repo application, which is typically deployed as a Docker container or standalone binary. The supply chain risk is moderate, as the vulnerability depends on the configuration of external decoders (ImageMagick, ffmpeg) and the MMR configuration. Users should ensure they are using the latest patched version (v1.3.8) and review their deployment for any custom configurations that may enable the vulnerable thumbnailers.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The attacker must upload a malicious file and request a thumbnail.
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Medium due to the requirement for user interaction and the fact that the vulnerable thumbnailers are disabled by default. However, if enabled, the impact is severe, potentially allowing remote code execution.

Deep Dive & Mechanics

The vulnerability is a type confusion issue (CWE-843) in the thumbnail generation process of Matrix Media Repo. MMR uses external decoders like ImageMagick and ffmpeg to generate thumbnails for uploaded media files. The vulnerability occurs because MMR trusts the user-supplied file extension or MIME type to select the appropriate decoder.

Attack Flow:

1. An attacker uploads a file with a malicious payload disguised as an SVG, JPEGXL, or MP4 file.
2. The attacker requests a thumbnail for this file.
3. MMR, based on the user-supplied file type, invokes the corresponding decoder (e.g., ImageMagick for SVG/JPEGXL, ffmpeg for MP4).
4. The decoder (ImageMagick or ffmpeg) processes the file, potentially invoking additional decoders (e.g., Ghostscript for PDFs) due to the file's actual content.
5. If Ghostscript or other decoders are available, the attacker can achieve arbitrary code execution.

Root Cause: MMR did not validate the actual MIME type of the uploaded file before thumbnailing. It relied solely on user-supplied metadata, allowing an attacker to trick the system into using a different decoder than intended.

Patched Code: In MMR v1.3.8, the code now inspects the actual MIME type of the media file using a robust MIME detection library before selecting the thumbnailer. This prevents the type confusion attack.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.3.8):

# Vulnerable: Uses user-supplied file extension to select thumbnailer
def get_thumbnailer(file_path, user_supplied_mime):
    if user_supplied_mime == "image/svg+xml":
        return ImageMagickThumbnailer()
    elif user_supplied_mime == "image/jxl":
        return ImageMagickThumbnailer()
    elif user_supplied_mime == "video/mp4":
        return FfmpegThumbnailer()
    else:
        return DefaultThumbnailer()

Patched Code (v1.3.8):

# Patched: Uses actual MIME type detected from file content
import magic

def get_thumbnailer(file_path):
    actual_mime = magic.from_file(file_path, mime=True)
    if actual_mime == "image/svg+xml":
        return ImageMagickThumbnailer()
    elif actual_mime == "image/jxl":
        return ImageMagickThumbnailer()
    elif actual_mime == "video/mp4":
        return FfmpegThumbnailer()
    else:
        return DefaultThumbnailer()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable MMR instance (version < 1.3.8) with SVG, JPEGXL, or MP4 thumbnailers enabled.
• Access to upload files and request thumbnails.

Exploitation Steps:

1. Craft a malicious file: Create a file that claims to be an SVG but contains a PDF payload that triggers Ghostscript.

   <?xml version="1.0" encoding="UTF-8"?>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <foreignObject width="100" height="100">
       <div xmlns="http://www.w3.org/1999/xhtml">
         <iframe src="file:///etc/passwd"></iframe>
       </div>
     </foreignObject>
   </svg>
   

   Note: This is a simplified example. Actual exploitation would require a more sophisticated payload to trigger Ghostscript.

2. Upload the file: Use the Matrix API to upload the file with a MIME type of image/svg+xml.

3. Request a thumbnail: Request a thumbnail for the uploaded file.

4. Trigger the exploit: If ImageMagick is configured to use Ghostscript for PDFs, the thumbnailer will invoke Ghostscript, potentially executing arbitrary code.

Alternative Exploit (MP4):

1. Craft a malicious MP4 file: Create a file that claims to be MP4 but contains a crafted payload that exploits a vulnerability in ffmpeg.
2. Upload and request thumbnail: Similar to the SVG exploit.

Blue Team

Detection:

• Monitor for unusual file uploads with MIME types of image/svg+xml, image/jxl, or video/mp4.
• Monitor for thumbnail generation requests that result in high CPU or memory usage.
• Check for unexpected processes spawned by ImageMagick or ffmpeg (e.g., Ghostscript).

Hunting:

• Search logs for errors from ImageMagick or ffmpeg related to file parsing.
• Look for files with mismatched extensions and MIME types.

Lab Setup:

1. Deploy a vulnerable MMR instance (e.g., v1.3.7) in a Docker container.
2. Enable SVG, JPEGXL, and MP4 thumbnailers in the MMR config.
3. Install ImageMagick with Ghostscript support.
4. Use a test script to upload malicious files and request thumbnails.

Indicators of Compromise (IOCs)

• File Hashes: (Example hashes for known malicious files - none publicly available for this CVE)
• Network Indicators:
  • Unusual outbound connections from the MMR server to external IPs (if the exploit downloads a payload).
  • High volume of thumbnail requests for SVG/JPEGXL/MP4 files.
• System Indicators:
  • Unexpected processes: gs (Ghostscript), ffmpeg with unusual arguments.
  • Files in /tmp or other writable directories with suspicious names.
  • Modified system files or new user accounts.
• Log Indicators:
  • ImageMagick errors: attempt to perform an operation not allowed by the security policy.
  • ffmpeg errors: Invalid data found when processing input.

Detection Engineering

YARA Rule

rule CVE_2024_56515_MMR_TypeConfusion {
    meta:
        description = "Detects files attempting to exploit CVE-2024-56515 in Matrix Media Repo"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-56515"
    strings:
        $svg_magic = { 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E } // <?xml version
        $pdf_magic = { 25 50 44 46 } // %PDF
        $mp4_magic = { 66 74 79 70 4D 53 4E 56 } // ftypMSNV (MP4)
        $jxl_magic = { FF 0A } // JPEG XL header
    condition:
        ($svg_magic at 0 and $pdf_magic) or
        ($mp4_magic at 0 and $pdf_magic) or
        ($jxl_magic at 0 and $pdf_magic)
}

Sigma Rule

title: CVE-2024-56515 - Matrix Media Repo Thumbnailer Type Confusion
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-56515 by uploading files with mismatched MIME types
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: matrix_media_repo
detection:
    selection:
        event: "thumbnail_request"
        mime_type:
            - "image/svg+xml"
            - "image/jxl"
            - "video/mp4"
    condition: selection
falsepositives:
    - Legitimate use of these file types
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56515 - MMR Thumbnailer Type Confusion"; flow:to_server,established; content:"POST"; http_method; content:"/_matrix/media/"; http_uri; content:"upload"; http_uri; pcre:"/(image\/svg\+xml|image\/jxl|video\/mp4)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to MMR v1.3.8 or later.
2. If upgrade is not possible, disable SVG, JPEGXL, and MP4 thumbnailers in the MMR config.
3. Disable Ghostscript in ImageMagick's policy.xml:

   <policy domain="coder" rights="none" pattern="PS" />
   <policy domain="coder" rights="none" pattern="PDF" />
   <policy domain="coder" rights="none" pattern="XPS" />
   

4. Restrict ffmpeg decoders by compiling with limited codecs or using a container with minimal capabilities.

Long-term Mitigations:

• Implement strict MIME type validation for all uploaded files.
• Use containerization (e.g., Docker) to isolate the thumbnailer processes.
• Regularly update ImageMagick and ffmpeg to the latest versions.
• Monitor for unusual thumbnail generation activity.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.