CVE-2024-56515: 
Linux openSUSE vulnerability analysis and mitigation

Matrix Media Repo (MMR), a highly configurable multi-homeserver media repository for Matrix, was found to have a vulnerability (CVE-2024-56515) disclosed on January 16, 2025. The vulnerability affects versions prior to 1.3.8, where if SVG or JPEGXL thumbnailers are enabled (disabled by default), users could upload files claiming to be these types and request thumbnails to invoke different decoders in ImageMagick, potentially leading to unauthorized code execution (GitHub Advisory).

The vulnerability stems from the way MMR handles thumbnail generation for certain file types. When processing SVG or JPEGXL files, the system could invoke ImageMagick decoders, which in some installations includes the capability to run Ghostscript for image decoding. Similarly, for MP4 thumbnailers, the issue could occur with ffmpeg installations. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N, indicating network attack vector with low attack complexity (NVD).

The vulnerability could allow attackers to execute arbitrary code through ImageMagick's Ghostscript capabilities or ffmpeg installations when processing certain file types. While the vulnerable thumbnailers (SVG, JPEGXL, and MP4) are disabled by default, if enabled, they could lead to unauthorized code execution and potential system compromise (GitHub Advisory).

The vulnerability has been fixed in MMR v1.3.8, which now inspects the mimetype of media prior to thumbnailing and selects thumbnailers based on those results instead of relying on user-supplied values. For users unable to upgrade, it is recommended to disable SVG, JPEGXL, and MP4 thumbnail types in the MMR config. Additional security measures include using containers to limit the impact of vulnerabilities, disabling unsafe file types in ImageMagick, and compiling ffmpeg with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default (GitHub Release).