Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-56515— Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo

Quick assessment

Affected
t2bot matrix-media-repo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Matrix是一个雄心勃勃的新生态系统，用于开放联合即时消息和 VoIP。 Matrix存在代码问题漏洞，该漏洞源于Matrix Media Repo如果启用了SVG或JPEGXL缩略图，用户可以上传声称属于这两种类型的文件并请求缩略图以调用ImageMagick中的其他解码器。

CVSS 6.8 · Medium EPSS 0.65% · P51

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-56515

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo
Source: CVE Program / CVE List V5
Vulnerability Description
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Matrix 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Matrix是一个雄心勃勃的新生态系统，用于开放联合即时消息和 VoIP。 Matrix存在代码问题漏洞，该漏洞源于Matrix Media Repo如果启用了SVG或JPEGXL缩略图，用户可以上传声称属于这两种类型的文件并请求缩略图以调用ImageMagick中的其他解码器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
t2bot matrix-media-repo < 1.3.8 -

II. Public POCs for CVE-2024-56515

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-56515

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-56515 (1)

Vendor Pages for CVE-2024-56515 (1)

Same Patch Batch · t2bot · 2025-01-16 · 5 CVEs total

CVE-2024-36403 5.3 MEDIUM Denial of service/high operating costs through unauthenticated downloads in Matrix Media R
CVE-2024-36402 5.3 MEDIUM Unauthenticated writes to the media repository allow planting of problematic content in Ma
CVE-2024-52791 5.3 MEDIUM Denial of service through memory exhaustion in Matrix Media Repo
CVE-2024-52602 5.0 MEDIUM Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo

IV. Related Vulnerabilities

Same product: matrix-media-repo
Same vendor: t2bot
Same weakness: CWE-502