CVE-2024-47771: Element Desktop Token Exposure Vulnerability

CVE-2024-47771 Overview

CVE-2024-47771 affects Element Desktop, a Matrix client for desktop platforms. Versions 1.11.70 through 1.11.80 contain a flaw that can expose the user's access token to third parties under specially crafted conditions. The maintainers identified at least one exploitation vector involving malicious widgets, but other vectors may exist. The issue is tracked as GHSA-963w-49j9-gxj6 and classified under [CWE-200] Information Exposure. Element released version 1.11.81 to remediate the flaw. Users who cannot upgrade immediately should avoid granting permissions to untrusted widgets.

Critical Impact
An exposed Matrix access token allows attackers to impersonate the victim, read messages, send messages, and access room membership across the user's Matrix account.

Affected Products

Element Desktop 1.11.70
Element Desktop versions 1.11.71 through 1.11.80
Fixed in Element Desktop 1.11.81

Discovery Timeline

2024-10-15 - CVE-2024-47771 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47771

Vulnerability Analysis

Element Desktop is an Electron-based Matrix client that intercepts media requests in the main process to inject authentication headers. The main process uses session.defaultSession.webRequest.onBeforeRequest to identify Matrix media URLs and attach the user's access token. The vulnerability stems from insufficient URL validation and incomplete separation between the main process and untrusted widget contexts. Widgets granted permissions could influence URL matching or homeserver resolution to trigger token attachment on requests directed at attacker-controlled destinations. The result is disclosure of the Matrix access token to third parties.

Root Cause

The root cause is loose URL matching in the media authentication handler combined with an implicit trust that requested URLs targeted the user's own homeserver. The original code used url.includes("/_matrix/media/v3/download") string matching against the raw request URL. This permits the substring to appear in query parameters, fragments, or non-homeserver paths. The main process had no channel to confirm the user's actual homeserver before attaching credentials.

Attack Vector

A malicious or compromised widget loaded inside Element Desktop can craft requests that match the media URL substring while pointing to an attacker-controlled origin. When the main process intercepts these requests, it attaches the Matrix access token via authentication headers, leaking the credential to the third party. Exploitation requires the user to grant permissions to the widget, which maps to the User Interaction requirement in the CVSS vector.

typescript

// Patch: src/media-auth.ts - stricter URL parsing and homeserver validation
/**
 * Get the homeserver url
 * This requires asking the renderer process for the homeserver url.
 */
async function getHomeserverUrl(window: BrowserWindow): Promise<string> {
    return new Promise((resolve) => {
        ipcMain.once("homeserverUrl", (_, homeserver) => {
            resolve(homeserver);
        });
        window.webContents.send("homeserverUrl"); // ping now that the listener exists
    });
}

export function setupMediaAuth(window: BrowserWindow): void {
    session.defaultSession.webRequest.onBeforeRequest(async (req, callback) => {
        try {
            const url = new URL(req.url);
            if (
                !url.pathname.startsWith("/_matrix/media/v3/download") &&
                !url.pathname.startsWith("/_matrix/media/v3/thumbnail")
            ) {
                return callback({});
            }
            // ... additional homeserver validation
        } catch (e) { /* ... */ }
    });
}
// Source: https://github.com/element-hq/element-desktop/commit/6c78684e84ba7f460aedba6f017760e2323fdf4b

The renderer-side change exposes the homeserver URL over IPC so the main process can validate request destinations:

typescript

// Patch: src/vector/platform/ElectronPlatform.tsx
// `homeserverUrl` (IPC) is requested by the main process. A reply is sent over the same channel.
window.electron.on("homeserverUrl", () => {
    window.electron!.send("homeserverUrl", MatrixClientPeg.get()?.getHomeserverUrl());
});
// Source: https://github.com/element-hq/element-web/commit/63c8550791a0221189f495d6458fee7db601c789

Detection Methods for CVE-2024-47771

Indicators of Compromise

Outbound HTTPS requests from Element.exe (or the Element binary on macOS/Linux) to hosts that are not the user's configured Matrix homeserver and contain Authorization: Bearer headers.
Widget URLs loaded by Element Desktop resolving to unknown or newly registered domains.
Requests to paths containing /_matrix/media/v3/download or /_matrix/media/v3/thumbnail directed at non-homeserver origins.

Detection Strategies

Inventory installed Element Desktop versions across managed endpoints and flag any build in the 1.11.70 through 1.11.80 range.
Correlate widget activity in Matrix room audit logs with unexpected outbound network flows from Element processes.
Inspect proxy or TLS-inspection logs for Authorization headers being sent to domains outside the user's known homeserver list.

Monitoring Recommendations

Alert on Element Desktop process network connections to domains that do not match the sanctioned homeserver allowlist.
Monitor endpoint telemetry for Element Desktop child processes or renderer contexts loading remote widget content from uncategorized domains.
Review Matrix server-side logs for anomalous API activity following widget permission grants, such as sudden bulk reads or message sends from a user session.

How to Mitigate CVE-2024-47771

Immediate Actions Required

Upgrade all Element Desktop installations to version 1.11.81 or later.
Rotate Matrix access tokens for users who ran affected versions and interacted with untrusted widgets. Invalidate active sessions from the Matrix homeserver's session management interface.
Audit widget permission grants in Matrix rooms and revoke access for any widgets from unverified sources.

Patch Information

Element published a fix in Element Desktop 1.11.81. The patch is documented in GitHub Security Advisory GHSA-963w-49j9-gxj6 and implemented across two commits: element-desktop 6c78684 and element-web 63c8550. The fix replaces substring matching with URL parsing, introduces a homeserverUrl IPC channel, and restricts access token attachment to requests targeting the user's own homeserver.

Workarounds

Do not grant permissions to widgets from unknown or untrusted sources.
Remove or disable existing widgets in shared rooms until endpoints are patched.
Restrict widget usage through Matrix homeserver policy configuration where administrators control widget allowlists.

bash

# Verify installed Element Desktop version on Linux
element-desktop --version

# Windows PowerShell: enumerate installed Element Desktop builds
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "Element*" } |
  Select-Object DisplayName, DisplayVersion