CVE-2021-21320 User content sandbox can be confused into opening arbitrary documents
Attackers can trick users into opening unexpected documents via sandbox confusion, though sensitive data remains protected.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21320?
CVE-2021-21320 is a low-severity vulnerability in matrix-org matrix-react-sdk, published on 2 Mar 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that cannot access Matrix user data, so messages and secrets are not at risk. This has been fixed in version 3.15.0.
Weakness: CWE-345
Which versions are affected by CVE-2021-21320?
2 open source packages ship an affected version, including matrix-react-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-react-sdk npm | All versions | 3.15.0 |
matrix-react-sdk npm | All versions | 3.15.0 |
Products include Matrix-React-Sdk Project Matrix-React-Sdk.
How do I fix CVE-2021-21320?
Upgrade matrix-react-sdk to 3.15.0 or later.
Is CVE-2021-21320 being exploited?
There is no known exploitation of CVE-2021-21320 in the wild and no public exploit code.
Other vulnerabilities in matrix-org matrix-react-sdk
- CVE-2023-28103 Prototype pollution in matrix-react-sdk
- CVE-2023-37259 Cross site scripting in Export Chat feature
- CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
- CVE-2021-32622 File upload local preview can run embedded scripts after user interaction
Sources
Also known as GHSA-52mq-6jcv-j79x.