CVE-2025-59161

Executive Summary

CVE-2025-59161 is a vulnerability in Element Web and Element Desktop, a Matrix web client built using the Matrix React SDK. The issue stems from insufficient validation of room predecessor links, allowing a remote attacker to temporarily replace a room's entry in the user's room list with an unrelated attacker-controlled room. While the effect is temporary and can be fixed by a page refresh, it can confuse users into acting on incorrect assumptions, potentially leading to social engineering attacks. The vulnerability has been patched in version 1.11.112.

Supply Chain & Package Security

This vulnerability affects the Element Web and Element Desktop applications, which are distributed as standalone packages and also available via package managers like npm. The core vulnerable component is the matrix-react-sdk library. Users should ensure they are using the latest version of the SDK and the client applications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): None (N) - The attacker does not need any privileges.
• User Interaction (UI): Required (R) - The victim must interact with the malicious room link.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): Low (L) - The attacker can modify the room list display.
• Availability (A): None (N) - No denial of service.

Threat Level: Medium. The attack requires user interaction and the effect is temporary, but it can be used for social engineering and phishing.

Deep Dive & Mechanics

The vulnerability lies in how Element Web handles room predecessor links. In the Matrix protocol, rooms can have a predecessor field that points to a previous version of the room. This is used for room upgrades. However, Element Web did not properly validate that the predecessor link actually points to a legitimate previous version of the same room.

An attacker can craft a malicious room that includes a predecessor field pointing to an unrelated room. When a user interacts with this malicious room (e.g., by clicking a link or being invited), Element Web may incorrectly update the user's room list, replacing the legitimate room's entry with the attacker's room. This is a client-side issue and does not affect the Matrix server.

The fix in version 1.11.112 adds validation to ensure that the predecessor link is valid and points to a room that is actually a predecessor of the current room.

Vulnerable vs. Patched Code

The vulnerable code is in the matrix-react-sdk library, specifically in the room list handling logic. The exact code is not publicly available, but the fix involves adding checks to verify the predecessor field.

Vulnerable Code (Conceptual):

// No validation of predecessor link
function handleRoomPredecessor(room) {
    const predecessor = room.getPredecessor();
    if (predecessor) {
        // Directly update room list with predecessor room
        updateRoomList(predecessor.roomId);
    }
}

Patched Code (Conceptual):

// Validate predecessor link
function handleRoomPredecessor(room) {
    const predecessor = room.getPredecessor();
    if (predecessor) {
        // Check if predecessor is a valid previous version of this room
        if (isValidPredecessor(room.roomId, predecessor.roomId)) {
            updateRoomList(predecessor.roomId);
        } else {
            console.warn("Invalid predecessor link detected");
        }
    }
}

Exploitation & Lab Setup

Red Team

1. Setup:

   • Create a malicious Matrix room on any public or private Matrix server.
   • Set the predecessor field of this room to point to a legitimate room that the target user is a member of.
   • Send an invitation or a link to the malicious room to the target user.

2. Execution:

   • The target user clicks the link or accepts the invitation.
   • Element Web processes the predecessor field and incorrectly updates the room list.
   • The legitimate room is replaced by the attacker's room in the user's room list.
   • The attacker can then use this to impersonate the legitimate room or conduct social engineering.

3. Cleanup:

   • The effect is temporary. The user can fix it by refreshing the page.

Blue Team

1. Detection:

   • Monitor for unusual room list changes reported by users.
   • Look for Matrix events with suspicious predecessor fields.
   • Use the detection rules provided below.

2. Response:

   • Advise users to refresh their Element Web client if they notice unexpected room list changes.
   • Ensure all users are upgraded to version 1.11.112 or later.
   • Investigate any reports of social engineering attempts related to room list manipulation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Matrix events with predecessor fields pointing to unrelated rooms.
  • Unusual room invitations from unknown users.
• Host IOCs:
  • Element Web client version < 1.11.112.
  • Unexpected room list entries in the Element Web interface.
• File IOCs:
  • N/A

Detection Engineering

YARA Rule

rule CVE_2025_59161_Element_Predecessor {
    meta:
        description = "Detects potential exploitation of CVE-2025-59161 in Element Web logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59161"
    strings:
        $predecessor = "predecessor" nocase
        $room_id = /![\w-]+:[\w.]+/  // Matrix room ID pattern
    condition:
        $predecessor and #room_id > 1
}

Sigma Rule

title: CVE-2025-59161 - Element Web Room Predecessor Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-59161 in Element Web logs
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59161
logsource:
    product: element_web
    service: client_logs
detection:
    selection:
        EventID: 1001  // Example event ID for room list update
        Message|contains: "predecessor"
    condition: selection
falsepositives:
    - Legitimate room upgrades
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-59161 - Element Web Room Predecessor Manipulation"; flow:to_server,established; content:"predecessor"; nocase; content:"room_id"; nocase; distance:0; within:100; reference:cve,2025-59161; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:

   • Upgrade Element Web and Element Desktop to version 1.11.112 or later.
   • Instruct users to refresh their client if they notice unexpected room list changes.

2. Long-term:

   • Implement input validation for all Matrix protocol fields.
   • Conduct regular security audits of the matrix-react-sdk library.
   • Monitor for similar vulnerabilities in other Matrix clients.

3. Compensating Controls:

   • Use a web application firewall (WAF) to filter malicious Matrix events.
   • Educate users about the risks of clicking on unknown room links.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert