Description
A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk’s getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the ‘leaveRoomChain()’ method, so leaving a room will also trigger the bug.
Recommendation
Update the matrix-js-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 34.3.1
- Patched version(s): 34.3.1
References
Could your website be exposed too?
SmartScanner can check your website for matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
- matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver - CVE-2021-40823
- matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
- matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification - CVE-2022-39250
You might also like:
See something that needs correcting? Let us knowUpdated August 20, 2024