CVE-2023-28427 Prototype pollution in matrix-js-sdk

What is CVE-2023-28427?

CVE-2023-28427 is a high-severity vulnerability in matrix-org matrix-js-sdk, published on 28 Mar 2023.

Official description

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-1321

Which versions are affected by CVE-2023-28427?

2 open source packages ship an affected version, including matrix-js-sdk. It affects 1 product.

Products include Matrix Javascript Sdk.

How do I fix CVE-2023-28427?

Upgrade matrix-js-sdk to 24.0.0 or later.

Is CVE-2023-28427 being exploited?

There is no known exploitation of CVE-2023-28427 in the wild and no public exploit code.

Other vulnerabilities in matrix-org matrix-js-sdk

• CVE-2022-39250 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification High 8.6
• CVE-2022-39251 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion High 8.6
• CVE-2022-36059 Prototype pollution in matrix-js-sdk High 8.2
• CVE-2022-39249 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions High 7.5
• CVE-2021-40823 matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2024-KH83435, DEBIAN-CVE-2023-28427, GHSA-mwq8-fjpf-c2gr, MGASA-2023-0132, UBUNTU-CVE-2023-28427, openSUSE-SU-2024:12823-1.