Update dependency matrix-js-sdk to v34 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
matrix-js-sdk	^32.0.0 -> ^34.0.0

GitHub Vulnerability Alerts

CVE-2024-42369

Impact

A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug.

Even if the CVSS score would be 4.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L) we classify this as High severity issue.

Patches

This was patched in matrix-js-sdk 34.3.1.

Workarounds

Sanity check rooms before passing them to the matrix-js-sdk or avoid calling either getRoomUpgradeHistory or leaveRoomChain.

References

N/A.

CVE-2024-47080

Impact

In matrix-js-sdk versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method implements functionality proposed in MSC3061 and can be used by clients to share historical message keys with newly invited users, granting them access to past messages in the room.

However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks.

Note that this only affects clients running the SDK with the legacy crypto stack. Clients using the new Rust cryptography stack (i.e. those that call MatrixClient.initRustCrypto() instead of MatrixClient.initCrypto()) are unaffected by this vulnerability, because MatrixClient.sendSharedHistoryKeys() raises an exception in such environments.

Patches

Fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionality.

Workarounds

Remove use of affected functionality from clients.

References

• MSC3061

For more information

If you have any questions or comments about this advisory, please email us at security at matrix.org.

CVE-2024-50336

Summary

matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver.

Details

The Matrix specification demands homeservers to perform validation of the server-name and media-id components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk fails to perform this validation.

Patches

Fixed in matrix-js-sdk 34.11.1.

Workarounds

None.

References

• https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5
• https://blog.doyensec.com/2024/07/02/cspt2csrf.html

---

Release Notes

matrix-org/matrix-js-sdk (matrix-js-sdk)

v34.11.1

Compare Source

====================================================================================================

v34.10.0

Compare Source

====================================================================================================

🦖 Deprecations

• Deprecate CreateSecretStorageOpts.keyBackupInfo used in CryptoApi.bootstrapSecretStorage. (#​4474). Contributed by @​florianduros.
• Add CryptoApi.encryptToDeviceMessages() and deprecate Crypto.encryptAndSendToDevices() (#​4380). Contributed by @​hughns.
• Remove abandoned MSC3886, MSC3903, MSC3906 experimental implementations (#​4469). Contributed by @​t3chguy.
• Deprecate MatrixClient.getDehydratedDevice (#​4467). Contributed by @​florianduros.
• Deprecate top level crypto events re-export (#​4444). Contributed by @​florianduros.

✨ Features

• Add CryptoApi.encryptToDeviceMessages() and deprecate Crypto.encryptAndSendToDevices() (#​4380). Contributed by @​hughns.
• Do not rotate MatrixRTC media encryption key when a new member joins a session (#​4472). Contributed by @​hughns.
• Avoid <sender>|<session> notation in log messages (#​4473). Contributed by @​richvdh.
• Refactor/simplify Promises in MatrixRTCSession (#​4466). Contributed by @​AndrewFerr.
• Prepare delayed call leave events more reliably (#​4447). Contributed by @​AndrewFerr.

🐛 Bug Fixes

• Fix DelayedEventInfo type (#​4446). Contributed by @​AndrewFerr.

v34.9.0

Compare Source

==================================================================================================

🦖 Deprecations

• Deprecate the crypto events which are not used by the rust-crypto (#​4442). Contributed by @​florianduros.

🐛 Bug Fixes

• Fix the rust crypto import in esm environments. (#​4445). Contributed by @​saul-jb.
• Fix MatrixRTC sender key wrapping (#​4441). Contributed by @​hughns.

v34.8.0

Compare Source

==================================================================================================
This release removes insecure functionality, resolving CVE-2024-47080 / GHSA-4jf8-g8wp-cx7c.

v34.7.0

Compare Source

==================================================================================================

🦖 Deprecations

• RTCSession cleanup: deprecate getKeysForParticipant() and getEncryption(); add emitEncryptionKeys() (#​4427). Contributed by @​hughns.

✨ Features

• Bump matrix-rust-sdk to 9.1.0 (#​4435). Contributed by @​richvdh.
• Rotate Matrix RTC media encryption key when a new member joins a call for Post Compromise Security (#​4422). Contributed by @​hughns.
• Update media event content types to include captions (#​4403). Contributed by @​tulir.
• Update OIDC registration types to match latest MSC2966 state (#​4432). Contributed by @​t3chguy.
• Add CryptoApi.pinCurrentUserIdentity and UserIdentity.needsUserApproval (#​4415). Contributed by @​richvdh.

v34.6.0

Compare Source

==================================================================================================

🦖 Deprecations

• Element-R: Mark unsupported MatrixClient methods as deprecated (#​4389). Contributed by @​richvdh.

✨ Features

• Add crypto mode setting for invisible crypto, and apply it to decrypting events (#​4407). Contributed by @​uhoreg.
• Don't share full key history for RTC per-participant encryption (#​4406). Contributed by @​hughns.
• Export membership types (#​4405). Contributed by @​Johennes.
• Fix sending redacts in embedded (widget) mode (#​4398). Contributed by @​toger5.
• Expose the event ID of a call membership (#​4395). Contributed by @​robintown.
• MSC4133 - Extended profiles (#​4391). Contributed by @​Half-Shot.

v34.5.0

Compare Source

==================================================================================================

🦖 Deprecations

• Deprecate unused callback hooks CryptoCallbacks.onSecretRequested and CryptoCallbacks.getDehydrationKey (#​4376). Contributed by @​richvdh.

v34.4.0

Compare Source

==================================================================================================

✨ Features

• Use non-legacy calls if any are found (#​4337). Contributed by @​AndrewFerr.

🐛 Bug Fixes

• Retry event decryption failures on first failure (#​4346). Contributed by @​hughns.
• Ensure "type" = "module" ES declaration in pre-release.sh (#​4350). Contributed by @​BLCK-B.
• Handle MatrixRTC encryption keys arriving out of order (#​4345). Contributed by @​hughns.
• Resend MatrixRTC encryption keys if a membership has changed (#​4343). Contributed by @​hughns.

v34.3.1

Compare Source

==================================================================================================

v34.3.0

Compare Source

==================================================================================================

✨ Features

• Bump matrix-widget-api (#​4336). Contributed by @​AndrewFerr.
• Also check for MSC3757 for session state keys (#​4334). Contributed by @​AndrewFerr.
• Support Futures via widgets (#​4311). Contributed by @​AndrewFerr.
• Support MSC4140: Delayed events (Futures) (#​4294). Contributed by @​AndrewFerr.
• Handle late-arriving m.room_key.withheld messages (#​4310). Contributed by @​richvdh.
• Be specific about what is considered a MSC4143 call member event. (#​4328). Contributed by @​toger5.
• Add index.ts for matrixrtc module (#​4314). Contributed by @​toger5.

🐛 Bug Fixes

• Fix hashed ID server lookups with no Olm (#​4333). Contributed by @​dbkr.

v34.2.0

Compare Source

==================================================================================================

🐛 Bug Fixes

• Element-R: detect "withheld key" UTD errors, and mark them as such (#​4302). Contributed by @​richvdh.

v34.1.0

Compare Source

==================================================================================================

✨ Features

• Add ability to choose how many timeline events to sync when peeking (#​4300). Contributed by @​jgarplind.
• Remove redundant hack for using the old pickle key in rust crypto (#​4282). Contributed by @​richvdh.
• Add fetching the well known in embedded mode. (#​4259). Contributed by @​toger5.

🐛 Bug Fixes

• Fix room state being updated with old (now overwritten) state and emitting for those updates. (#​4242). Contributed by @​toger5.
• Fix incorrect "Olm is not available" errors (#​4301). Contributed by @​richvdh.
• Fix build for example script (#​4286). Contributed by @​richvdh.
• Declare matrix-js-sdk as an ES module (#​4285). Contributed by @​richvdh.

v34.0.0

Compare Source

==================================================================================================

🚨 BREAKING CHANGES

• Fetch capabilities in the background (#​4246). Contributed by @​dbkr.

✨ Features

• Prefix the user+device state key if needed (#​4262). Contributed by @​AndrewFerr.
• Use legacy call membership if anyone else is (#​4260). Contributed by @​AndrewFerr.
• Fetch capabilities in the background (#​4246). Contributed by @​dbkr.
• Use server name instead of homeserver url to allow well-known lookups during QR OIDC reciprocation (#​4233). Contributed by @​t3chguy.
• Add via parameter for MSC4156 (#​4247). Contributed by @​Johennes.
• Make the js-sdk compatible with MSC preferred foci and active focus. (#​4195). Contributed by @​toger5.
• Replace usages of setImmediate with setTimeout for wider compatibility (#​4240). Contributed by @​t3chguy.

🐛 Bug Fixes

• [Backport staging] Fix "Unable to restore session" error (#​4299). Contributed by @​RiotRobot.
• [Backport staging] Fix error when sending encrypted messages in large rooms (#​4297). Contributed by @​RiotRobot.
• Element-R: Fix resource leaks in verification logic (#​4263). Contributed by @​richvdh.
• Upgrade Rust Crypto SDK to 6.1.0 (#​4261). Contributed by @​richvdh.
• Correctly transform base64 with multiple instances of + or / (#​4252). Contributed by @​robintown.
• Work around spec bug for m.room.avatar state event content type (#​4245). Contributed by @​t3chguy.

v33.1.0

Compare Source

==================================================================================================

✨ Features

• MSC4108 support OIDC QR code login (#​4134). Contributed by @​t3chguy.
• Add crypto methods for export and import of secrets bundle (#​4227). Contributed by @​t3chguy.

🐛 Bug Fixes

• Fix screen sharing in recent Chrome (#​4243). Contributed by @​RiotRobot.
• Fix incorrect assumptions about required fields in /search response (#​4228). Contributed by @​t3chguy.
• Fix the queueToDevice tests for the new fakeindexeddb (#​4225). Contributed by @​dbkr.

v33.0.0

Compare Source

==================================================================================================

🚨 BREAKING CHANGES

• Remove more deprecated methods, fields, and exports (#​4217). Contributed by @​t3chguy.
• Remove deprecated methods and fields (#​4201). Contributed by @​t3chguy.

🦖 Deprecations

• Remove more deprecated methods, fields, and exports (#​4217). Contributed by @​t3chguy.
• Remove deprecated methods and fields (#​4201). Contributed by @​t3chguy.

✨ Features

• initRustCrypto: allow app to pass in the store key directly (#​4210). Contributed by @​richvdh.
• Preserve ESM for async imports to work correctly (#​4187). Contributed by @​ms-dosx86.

🐛 Bug Fixes

• Don't run migration for Rust crypto if the legacy store is empty (#​4218). Contributed by @​andybalaam.
• Bump matrix-sdk-crypto-wasm to 5.0.0 (#​4216). Contributed by @​richvdh.
• Wire up verification cancel & mismatch for rust crypto (#​4202). Contributed by @​t3chguy.
• Only pass id_server if we had one to begin with (#​4200). Contributed by @​t3chguy.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.