CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
Attackers can inject HTML into search results via plaintext messages, though CSP prevents script execution, affecting Matrix client users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-30609?
CVE-2023-30609 is a medium-severity cross-site scripting vulnerability in matrix-org matrix-react-sdk, published on 25 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
Weakness: CWE-74
Which versions are affected by CVE-2023-30609?
2 open source packages ship an affected version, including matrix-react-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-react-sdk npm | All versions | 3.71.0 |
matrix-react-sdk npm | All versions | 3.71.0 |
Linux distribution packages (2)
element-desktop openSUSE:Tumbleweed | All versions | 1.11.30-1.1 |
element-web openSUSE:Tumbleweed | All versions | 1.11.30-1.1 |
Products include Matrix-React-Sdk Project Matrix-React-Sdk.
How do I fix CVE-2023-30609?
Upgrade matrix-react-sdk to 3.71.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-30609 being exploited?
There is no known exploitation of CVE-2023-30609 in the wild and no public exploit code.
Other vulnerabilities in matrix-org matrix-react-sdk
Sources
Also known as CLEANSTART-2024-ZD82819, GHSA-xv83-x443-7rmw, openSUSE-SU-2024:12884-1, openSUSE-SU-2024:12895-1.