Skip to content
OpenAdvisories
Medium · 5.0 CVE-2024-52602 EUVD-2025-0103GHSA-r6jg-jfv6-2fjvGO-2025-3399

Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo

Published Jan 16, 2025 · Updated Feb 12, 2025 · Assigned by GitHub_M

Vendor: t2bot Product: matrix-media-repo Package: github.com/t2bot/matrix-media-repo Ecosystem: Go

Description

Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.

Affected products

VendorProductAffectedFixed
t2bot matrix-media-repo < 1.3.8 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 govulncheck-vulndb 0.0.20250128T150132-150000.1.29.1 SUSE-SU-2025:0297-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250117T214834-1.1 openSUSE-SU-2025:14704-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20250128T150132-150000.1.29.1 SUSE-SU-2025:0297-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/t2bot/matrix-media-repo < 1.3.8 1.3.8 GHSA-r6jg-jfv6-2fjv

Advisories 2

References