matrix-react-sdk up to 3.68.x Key Location prototype pollution

Summaryinfo

A vulnerability was found in matrix-react-sdk up to 3.68.x. It has been declared as critical. This affects an unknown part of the component Key Location Handler. Executing a manipulation can lead to prototype pollution. The identification of this vulnerability is CVE-2023-28103. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in matrix-react-sdk up to 3.68.x (JavaScript Library). It has been declared as critical. This vulnerability affects some unknown processing of the component Key Location Handler. The manipulation with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect integrity, and availability. CVE summarizes:

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

The weakness was shared 03/29/2023 as GHSA-6g43-88cp-w5gv. The advisory is available at github.com. This vulnerability was named CVE-2023-28103 since 03/10/2023. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 3.69.0 eliminates this vulnerability. The upgrade is hosted for download at matrix.org.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• JavaScript Library

Name

• matrix-react-sdk

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40
• 3.41
• 3.42
• 3.43
• 3.44
• 3.45
• 3.46
• 3.47
• 3.48
• 3.49
• 3.50
• 3.51
• 3.52
• 3.53
• 3.54
• 3.55
• 3.56
• 3.57
• 3.58
• 3.59
• 3.60
• 3.61
• 3.62
• 3.63
• 3.64
• 3.65
• 3.66
• 3.67
• 3.68

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion