CVE-2024-52602

low-risk

Published 2025-01-16

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.

Do I need to act?

0.12% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.0/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Matrix-Media-Repo

Affected Vendors

T2Bot

References (5)

Release Notes https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8

Vendor Advisory https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2f...

Technical Description https://learn.snyk.io/lesson/ssrf-server-side-request-forgery

Technical Description https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

Technical Description https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golang

/ 100

low-risk

Severity 20/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal