CVE-2024-47080

{"id": "CVE-2024-47080", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-10-15T15:15:12.653", "references": [{"url": "https://github.com/matrix-org/matrix-js-sdk/commit/2fb1e659c81f75253c047832dc9dcc2beddfac5f", "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-4jf8-g8wp-cx7c", "source": "security-advisories@github.com"}, {"url": "https://github.com/matrix-org/matrix-spec-proposals/pull/3061", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these \"shared\" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. Note that this only affects clients running the SDK with the legacy crypto stack. Clients using the new Rust cryptography stack (i.e. those that call `MatrixClient.initRustCrypto()` instead of `MatrixClient.initCrypto()`) are unaffected by this vulnerability, because `MatrixClient.sendSharedHistoryKeys()` raises an exception in such environments. The vulnerability was fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality. As a workaround, remove use of affected functionality from clients."}, {"lang": "es", "value": "matrix-js-sdk es el SDK de Matrix Client-Server para JavaScript y TypeScript. En las versiones 9.11.0 a 34.7.0 de matrix-js-sdk, el m\u00e9todo `MatrixClient.sendSharedHistoryKeys` es vulnerable a la intercepci\u00f3n por parte de servidores dom\u00e9sticos maliciosos. El m\u00e9todo fue introducido por MSC3061) y se utiliza com\u00fanmente para compartir claves de mensajes hist\u00f3ricos con usuarios reci\u00e9n invitados, otorg\u00e1ndoles acceso a mensajes anteriores en la sala. Sin embargo, env\u00eda incondicionalmente estas claves \"compartidas\" a todos los dispositivos del usuario invitado, independientemente de si la identidad criptogr\u00e1fica del usuario est\u00e1 verificada o si los dispositivos del usuario est\u00e1n firmados por esa identidad. Esto permite al atacante inyectar potencialmente sus propios dispositivos para recibir claves hist\u00f3ricas confidenciales sin los controles de seguridad adecuados. Tenga en cuenta que esto solo afecta a los clientes que ejecutan el SDK con la pila criptogr\u00e1fica heredada. Los clientes que utilizan la nueva pila de criptograf\u00eda de Rust (es decir, aquellos que llaman a `MatrixClient.initRustCrypto()` en lugar de `MatrixClient.initCrypto()`) no se ven afectados por esta vulnerabilidad, porque `MatrixClient.sendSharedHistoryKeys()` genera una excepci\u00f3n en dichos entornos. La vulnerabilidad se solucion\u00f3 en matrix-js-sdk 34.8.0 eliminando la funcionalidad vulnerable. Como workaround, elimine el uso de la funcionalidad afectada de los clientes."}], "lastModified": "2024-10-16T16:38:43.170", "sourceIdentifier": "security-advisories@github.com"}