CVE-2024-36402: T2bot Matrix-media-repo Auth Bypass Flaw

CVE-2024-36402 Overview

CVE-2024-36402 affects Matrix Media Repo (MMR), a configurable multi-homeserver media repository for the Matrix protocol. Versions prior to 1.3.5 permit unauthenticated remote participants to trigger downloads and caching of remote media into the local repository. Once cached, that content becomes downloadable from the local homeserver without authentication. Unauthenticated remote adversaries can abuse this design to plant problematic or illegal content into a target repository. The maintainer released MMR 1.3.5 with new authenticated download endpoints as a partial mitigation. The legacy unauthenticated endpoints will be frozen in a future release to close the attack vector completely.

Critical Impact
Unauthenticated remote attackers can seed arbitrary remote media into a target MMR instance, causing that content to be served publicly from the victim server and creating reputational, operational, and legal exposure.

Affected Products

t2bot matrix-media-repo versions prior to 1.3.5
Matrix homeservers federated with MMR-backed deployments
Public Matrix instances exposing MMR download endpoints to the internet

Discovery Timeline

2025-01-16 - CVE-2024-36402 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36402

Vulnerability Analysis

The issue is a design-level authentication weakness classified under [CWE-287] (Improper Authentication). MMR historically implemented Matrix media federation endpoints that require no client authentication. When an unauthenticated actor requests a remote mxc:// URI through the local MMR, the repository fetches that content from the remote homeserver and caches it locally. The same content then becomes retrievable through the local server's unauthenticated download endpoints. This creates an indirect content-planting primitive that is fully driven by remote, unauthenticated participants.

Because the behavior follows the original Matrix media specification, the flaw is not an implementation bug but an inherited protocol design decision. The fix aligns MMR with MSC3916, which introduces authenticated media endpoints for the Matrix ecosystem.

Root Cause

MMR before 1.3.5 exposes media download and remote-fetch routes that do not require an access token. The server treats any remote mxc:// request as a legitimate cache-fill operation. No authorization check binds the caching action to a known local user or trusted federated peer.

Attack Vector

An attacker only needs network reach to the target MMR HTTP endpoints. The attacker uploads media to any homeserver they control, then requests that media from the victim MMR via its unauthenticated remote download route. The victim server pulls the content, caches it, and subsequently serves it to anonymous clients on the internet.

No authentication code path is required in this exploitation flow. Refer to the GHSA-8vmr-h7h5-cqhg advisory for the maintainer's technical description.

Detection Methods for CVE-2024-36402

Indicators of Compromise

Unusual growth in the MMR cache directory tied to mxc:// URIs from unknown or low-reputation homeservers.
HTTP access logs showing repeated unauthenticated GET requests to /_matrix/media/*/download/ and /thumbnail/ endpoints from a narrow set of source IPs.
Outbound HTTPS connections from the MMR host to federated homeservers with no prior interaction history.
Abuse reports referencing content hosted on your homeserver's media URL that no local user uploaded.

Detection Strategies

Baseline the ratio of authenticated to unauthenticated media requests and alert on sustained unauthenticated spikes.
Correlate cache-write events with the requesting client identity; flag writes triggered without a resolvable local session.
Hunt for repeated fetches of media from homeserver domains not present in your federation allowlist.

Monitoring Recommendations

Forward MMR access logs and reverse-proxy logs to a centralized analytics pipeline for retention and search.
Track per-IP request rates against media endpoints and alert on threshold breaches.
Monitor disk consumption of the MMR datastore and object storage buckets used as cache backends.

How to Mitigate CVE-2024-36402

Immediate Actions Required

Upgrade MMR to version 1.3.5 or later and enable the new authenticated media endpoints.
Configure clients and downstream homeservers to use the authenticated download routes exclusively.
Restrict federated media fetches through an allowlist of trusted homeservers where operationally feasible.
Review cached media for planted or abusive content and purge as required by your content policy.

Patch Information

The maintainer released MMR 1.3.5 introducing authenticated media endpoints as a partial mitigation. A future release will freeze the legacy unauthenticated endpoints to fully close the attack vector. Deployment guidance is documented in the GitHub security advisory GHSA-8vmr-h7h5-cqhg.

Workarounds

Apply strict per-IP rate limits at the reverse proxy in front of MMR to slow enumeration and bulk cache-planting.
Place MMR behind a web application firewall that enforces authentication headers on media routes where possible.
Disable public federation of media by scoping the media endpoints to internal networks until upgrade is complete.

bash

# Example nginx rate limit for MMR media endpoints
limit_req_zone $binary_remote_addr zone=mmr_media:10m rate=5r/s;

server {
    location /_matrix/media/ {
        limit_req zone=mmr_media burst=10 nodelay;
        proxy_pass http://mmr_upstream;
    }
}