CVE-2024-36402 json
Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo
published 2025-01-16 21 mo ago modified 2026-06-17 4 mo ago also GHSA-8vmr-h7h5-cqhg , GO-2025-3397 , EUVD-2025-0094
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.
Patch / fix
- go github.com/t2bot/matrix-media-repo 1.3.5
- t2bot matrix-media-repo 1.3.5
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250128T150132-150000.1.29.1
suse advisories SUSE-SU-2025:0297-1
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250117T214834-1.1
opensuse advisories openSUSE-SU-2025:14704-1
- github.com/matrix-org/matrix-spec-proposals#3916 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/t2bot/matrix-media-repo | <1.3.5 |
1.3.5 |
Affected products
- t2bot matrix-media-repo
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/matrix-org/matrix-spec-proposals/pull/3916
web, issue-tracking
-
github.com
/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-36402
advisory
-
github.com
/t2bot/matrix-media-repo
package
-
pkg.go.dev
/vuln/GO-2025-3397
web
Sources
- CVE List CVE-2024-36402
- GitHub Advisory GHSA-8vmr-h7h5-cqhg
- NVD CVE-2024-36402
- OSV GO-2025-3397
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.