CVE-2024-36402

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36402", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-27T15:59:57.030Z", "datePublished": "2025-01-16T19:19:19.373Z", "dateUpdated": "2025-02-12T20:31:21.273Z"}, "containers": {"cna": {"title": "Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg"}, {"name": "https://github.com/matrix-org/matrix-spec-proposals/pull/3916", "tags": ["x_refsource_MISC"], "url": "https://github.com/matrix-org/matrix-spec-proposals/pull/3916"}], "affected": [{"vendor": "t2bot", "product": "matrix-media-repo", "versions": [{"version": "< 1.3.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-16T19:19:19.373Z"}, "descriptions": [{"lang": "en", "value": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround."}], "source": {"advisory": "GHSA-8vmr-h7h5-cqhg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36402", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T19:52:36.257441Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:31:21.273Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36402", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T19:52:36.257441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:26:14.379Z"}}], "cna": {"title": "Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo", "source": {"advisory": "GHSA-8vmr-h7h5-cqhg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "t2bot", "product": "matrix-media-repo", "versions": [{"status": "affected", "version": "< 1.3.5"}]}], "references": [{"url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg", "name": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/matrix-org/matrix-spec-proposals/pull/3916", "name": "https://github.com/matrix-org/matrix-spec-proposals/pull/3916", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-16T19:19:19.373Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36402", "state": "PUBLISHED", "dateUpdated": "2025-02-12T20:31:21.273Z", "dateReserved": "2024-05-27T15:59:57.030Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-01-16T19:19:19.373Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "matrix-media-repo", "vendor": "t2bot", "versions": [{"status": "affected", "version": "< 1.3.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:t2bot:matrix-media-repo:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B2BD7DE-DC40-4CC9-89A7-40F3AEDBE012", "versionEndExcluding": "1.3.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround."}, {"lang": "es", "value": " Matrix Media Repo (MMR) es un repositorio multimedia para m\u00faltiples servidores dom\u00e9sticos altamente configurable para Matrix. La versi\u00f3n 1.3.5 de MMR permite, por dise\u00f1o, que los participantes remotos no autenticados activen una descarga y almacenamiento en cach\u00e9 de contenido multimedia remoto desde un servidor dom\u00e9stico remoto al repositorio multimedia local. Dicho contenido tambi\u00e9n se vuelve disponible para su descarga desde el servidor dom\u00e9stico local de manera no autenticada. La implicaci\u00f3n es que los adversarios remotos no autenticados pueden usar esta funcionalidad para introducir contenido problem\u00e1tico en el repositorio multimedia. MMR 1.3.5 introduce una mitigaci\u00f3n parcial en forma de nuevos endpoints que requieren autenticaci\u00f3n para las descargas multimedia. Los endpoints no autenticados se congelar\u00e1n en una versi\u00f3n futura, lo que cerrar\u00e1 el vector de ataque. Aunque son extremadamente limitados, los operadores de servidores pueden usar l\u00edmites de velocidad m\u00e1s estrictos basados en la direcci\u00f3n IP como workaround parcial."}], "id": "CVE-2024-36402", "lastModified": "2026-06-17T07:36:38.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36402", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-16T19:52:36.257441Z", "version": "2.0.3"}}]}, "published": "2025-01-16T20:15:32.047", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/matrix-org/matrix-spec-proposals/pull/3916"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}