CVE-2024-6303: 
NixOS vulnerability analysis and mitigation

CVE-2024-6303 affects Conduit versions 0.7.0 and earlier, where a missing authorization check in the Client-Server API allows unauthorized manipulation of room aliases. The vulnerability was discovered and disclosed on June 25, 2024, and was patched in version 0.8.0 released on June 12, 2024 (NVD, Conduit Changelog).

The vulnerability stems from a missing authorization check in the Client-Server API that allows any user to remove and add aliases to any room. The severity is rated as HIGH with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) according to NVD's assessment (NVD).

The vulnerability can be exploited for privilege escalation by moving the #admins alias to a room controlled by the attacker. This allows the attacker to execute privileged commands including resetting passwords, signing JSON with the server's key, and deactivating users (NVD).

The vulnerability requires an attacker to have a user account on the affected Conduit server. Once authenticated, they can exploit the missing authorization check to manipulate room aliases and gain elevated privileges (NVD).

The vulnerability has been fixed in Conduit version 0.8.0. Administrators are strongly advised to upgrade immediately, especially those running public homeservers with untrusted users. For affected servers, administrators should check if their admin bot responds to commands to verify if they've been compromised (Conduit Changelog).