CVE-2024-50336

## Vulnerability matrix-js-sdk before 34.11.0 fails to validate MXC URIs on the client side, leading to a path traversal vulnerability [3]. While the Matrix specification requires homeservers to validate MXC URIs to prevent path traversal, it does not mandate similar checks on the client side [1]. The SDK's insufficient validation allows crafted MXC URIs to traverse paths.

Exploitation

A malicious room member can send a specially crafted MXC URI that, when processed by a vulnerable client, causes the SDK to issue an authenticated GET request to the client's homeserver with an arbitrary path [4]. This attack requires no special privileges beyond being a member of a shared room; the victim does not need to interact with the URI beyond receiving it.

Impact

By exploiting this vulnerability, an attacker can leverage the victim's authenticated session to make arbitrary GET requests to the homeserver. This could allow the attacker to access sensitive endpoints, read private data, or perform actions on behalf of the victim, depending on the homeserver's API [4].

Mitigation

The vulnerability is fixed in matrix-js-sdk version 34.11.1 [3]. No workarounds are available; users should update to the patched version immediately [4].