CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

2023-04-2520:58:27

CWE-74

GitHub_M

www.cve.org

cve-2023-30609

matrix-react-sdk

html injection

search results

plaintext message

security patch

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

0.001 Low

EPSS

Percentile

37.4%

JSON

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

CNA Affected

[
  {
    "vendor": "matrix-org",
    "product": "matrix-react-sdk",
    "versions": [
      {
        "version": "< 3.71.0",
        "status": "affected"
      }
    ]
  }
]