matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4012 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4012-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     January 11, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:128.6.0esr-1~deb11u1     CVE ID         : CVE-2024-50336 CVE-2025-0237 CVE-2025-0238 CVE-2025-0239                      CVE-2025-0240 CVE-2025-0241 CVE-2025-0242 CVE-2025-0243

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1:128.6.0esr-1~deb11u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5841 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5841-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     January 10, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : thunderbird     CVE ID         : CVE-2024-50336 CVE-2025-0237 CVE-2025-0238 CVE-2025-0239                      CVE-2025-0240 CVE-2025-0241 CVE-2025-0242 CVE-2025-0243

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:128.6.0esr-1~deb12u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 134.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-04 advisory.

  - Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-0247)

  - Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5,     Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-0242)

  - The Matrix specification demands homeservers to perform validation of the server-name and media-id     components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a     similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk     fails to perform this validation. (CVE-2024-50336)

  - The WebChannel API, which is used to transport various information across processes, did not check the     sending principal but rather accepted the principal being sent. This could have led to privilege     escalation attacks. (CVE-2025-0237)

  - Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to     a potentially exploitable crash. (CVE-2025-0238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 134.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-04 advisory.

  - Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-0247)

  - Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5,     Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-0242)

  - The Matrix specification demands homeservers to perform validation of the server-name and media-id     components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a     similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk     fails to perform this validation. (CVE-2024-50336)

  - The WebChannel API, which is used to transport various information across processes, did not check the     sending principal but rather accepted the principal being sent. This could have led to privilege     escalation attacks. (CVE-2025-0237)

  - Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to     a potentially exploitable crash. (CVE-2025-0238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4326-1 advisory.

    - CVE-2024-50336: Fixed insufficient MXC URI validation which could allow client-side path traversal     (bsc#1234413)

    Other fixes:
    - Updated to Mozilla Thunderbird 128.5.2i (bsc#1234413):
      * fixed: Large virtual folders could be very slow
      * fixed: Message could disappear after moving from IMAP folder         followed by Undo and Redo
      * fixed: XMPP chat did not display messages sent inside a CDATA         element
      * fixed: Selected calendar day did not move forward at midnight
      * fixed: Today pane agenda sometimes scrolled for no apparent         reason
      * fixed: CalDAV calendars without offline support could degrade         start-up performance
      * fixed: Visual and UX improvements
      * fixed: Security fixes

    - Updated to Mozilla Thunderbird 128.5.1:
      * new: Add end of year donation appeal
      * fixed: Total message count for favorite folders did not work         consistently

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9b2a9cdf0b advisory.

    Update to 128.5.2

    * https://www.thunderbird.net/en-US/thunderbird/128.5.2esr/releasenotes/
    * https://www.mozilla.org/en-US/security/advisories/mfsa2024-69/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b32b4e1b88 advisory.

    Update to 128.5.2

    * https://www.thunderbird.net/en-US/thunderbird/128.5.2esr/releasenotes/
    * https://www.mozilla.org/en-US/security/advisories/mfsa2024-69/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 128.5.2esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-346-01 advisory.

    New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the mozilla-thunderbird security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 128.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-69 advisory.

  - The Matrix specification demands homeservers to perform validation of the server-name and media-id     components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a     similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk     fails to perform this validation. (CVE-2024-50336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-69 advisory.

  - The Matrix specification demands homeservers to perform validation of the server-name and media-id     components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a     similar check must also be performed on the client to prevent client-side path traversal. matrix-js-sdk     fails to perform this validation. (CVE-2024-50336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 574f7bc9-a141-11ef-84e9-901b0e9408dc advisory.

    matrix-js-sdk upstream reports:
    matrix-js-sdk before 34.11.0 is vulnerable to client-side               path traversal via crafted MXC URIs. A malicious room member               can trigger clients based on the matrix-js-sdk to issue               arbitrary authenticated GET requests to the client's               homeserver.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213985	Debian dla-4012 : thunderbird - security update	Nessus	Debian Local Security Checks	medium
213960	Debian dsa-5841 : thunderbird - security update	Nessus	Debian Local Security Checks	medium
213633	Mozilla Thunderbird < 134.0	Nessus	Windows	medium
213632	Mozilla Thunderbird < 134.0	Nessus	MacOS X Local Security Checks	medium
213070	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2024:4326-1)	Nessus	SuSE Local Security Checks	medium
213034	Fedora 40 : thunderbird (2024-9b2a9cdf0b)	Nessus	Fedora Local Security Checks	medium
212752	Fedora 41 : thunderbird (2024-b32b4e1b88)	Nessus	Fedora Local Security Checks	medium
212514	Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2024-346-01)	Nessus	Slackware Local Security Checks	medium
212420	Mozilla Thunderbird < 128.5.2	Nessus	Windows	medium
212419	Mozilla Thunderbird < 128.5.2	Nessus	MacOS X Local Security Checks	medium
210918	FreeBSD : Matrix clients -- mxc uri validation in js sdk (574f7bc9-a141-11ef-84e9-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2024-50336

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium