Cycle Vulnerability in Matrix JavaScript SDK Affects Messaging Client

CVE-2024-42369

What is CVE-2024-42369?

The Matrix JavaScript SDK, a client-server SDK that implements the Matrix messaging protocol, has a security vulnerability that could be exploited by a malicious home server. By crafting a specific room structure that leads to a cyclical reference among predecessors, the SDK’s getRoomUpgradeHistory function may enter an infinite recursion state. This results in the software hanging indefinitely, which can also be triggered when users attempt to leave such rooms using the leaveRoomChain() method. This critical issue highlights the need for robust security practices in managing room structures within messaging environments. The vulnerability has been addressed in matrix-js-sdk version 34.3.1.

References