URL preview setting for a room is controllable by the homeserver in matrix-react-sdk

Vulnerability

CVE-2024-42347 affects matrix-react-sdk, a React-based SDK for building Matrix chat/voip clients. A malicious homeserver can manipulate a user's account data to force the client to enable URL previews in end-to-end encrypted rooms. This causes any URLs present in encrypted messages to be sent to the homeserver, undermining the confidentiality of encrypted communications [1][4].

Exploitation

Exploitation requires a malicious or compromised homeserver. The attacker modifies the user's account data to set a flag that enables URL previews for a given room. No user interaction beyond being a member of the room is needed. Deployments that fully trust their homeserver, or operate within closed federations of trusted servers, are not affected [1].

Impact

An attacker controlling the homeserver gains the ability to observe the URLs that users click in encrypted rooms. While the message content itself remains encrypted, the URLs are leaked to the server, potentially exposing sensitive information such as authentication tokens or private resources [4].

Mitigation

The vulnerability is patched in matrix-react-sdk versions 3.105.0 and 3.105.1 [1][3]. Users are strongly advised to upgrade to the latest version. There are no known workarounds; the only alternative is to ensure the homeserver is trusted [1].