matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. Note that this only affects clients running the SDK with the legacy crypto stack. Clients using the new Rust cryptography stack (i.e. those that call `MatrixClient.initRustCrypto()` instead of `MatrixClient.initCrypto()`) are unaffected by this vulnerability, because `MatrixClient.sendSharedHistoryKeys()` raises an exception in such environments. The vulnerability was fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality. As a workaround, remove use of affected functionality from clients.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions     versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to     interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share     historical message keys with newly invited users, granting them access to past messages in the room.
    However, it unconditionally sends these shared keys to all of the invited user's devices, regardless of     whether the user's cryptographic identity is verified or whether the user's devices are signed by that     identity. This allows the attacker to potentially inject its own devices to receive sensitive historical     keys without proper security checks. Note that this only affects clients running the SDK with the legacy     crypto stack. Clients using the new Rust cryptography stack (i.e. those that call     `MatrixClient.initRustCrypto()` instead of `MatrixClient.initCrypto()`) are unaffected by this     vulnerability, because `MatrixClient.sendSharedHistoryKeys()` raises an exception in such environments.
    The vulnerability was fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality. As a     workaround, remove use of affected functionality from clients. (CVE-2024-47080)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions
    versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to
    interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share
    historical message keys with newly invited users, granting them access to past messages in the room.
    However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of
    whether the user's cryptographic identity is verified or whether the user's devices are signed by that
    identity. This allows the attacker to potentially inject its own devices to receive sensitive historical
    keys without proper security checks. Note that this only affects clients running the SDK with the legacy
    crypto stack. Clients using the new Rust cryptography stack (i.e. those that call
    `MatrixClient.initRustCrypto()` instead of `MatrixClient.initCrypto()`) are unaffected by this
    vulnerability, because `MatrixClient.sendSharedHistoryKeys()` raises an exception in such environments.
    The vulnerability was fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality. As a
    workaround, remove use of affected functionality from clients. (CVE-2024-47080)

ID	Name	Product	Family	Type	Severity
229396	Linux Distros Unpatched Vulnerability : CVE-2024-47080	Nessus	Misc.	Local	high
410244	SCA: security update for matrix-js-sdk (GHSA-4jf8-g8wp-cx7c)	Tenable Cloud Security	SCA Checks	Local	high
410244	SCA: security update for matrix-js-sdk (GHSA-4jf8-g8wp-cx7c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-47080

high

Tenable Plugins

high

high

high