CVE-2023-28103 Prototype pollution in matrix-react-sdk

What is CVE-2023-28103?

CVE-2023-28103 is a high-severity vulnerability in matrix-org matrix-react-sdk, published on 28 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

Weakness: CWE-1321

Which versions are affected by CVE-2023-28103?

2 open source packages ship an affected version, including matrix-react-sdk. It affects 1 product.

Products include Matrix-React-Sdk Project Matrix-React-Sdk.

How do I fix CVE-2023-28103?

Upgrade matrix-react-sdk to 3.69.0 or later.

Is CVE-2023-28103 being exploited?

There is no known exploitation of CVE-2023-28103 in the wild and no public exploit code.

Other vulnerabilities in matrix-org matrix-react-sdk

• CVE-2023-37259 Cross site scripting in Export Chat feature Medium 6.1
• CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting Medium 5.4
• CVE-2021-32622 File upload local preview can run embedded scripts after user interaction Medium 4.2
• CVE-2021-21320 User content sandbox can be confused into opening arbitrary documents Low 2.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2024-LQ80354, GHSA-6g43-88cp-w5gv.