matrix-js-sdk up to 23.x Event prototype pollution

Summaryinfo

A vulnerability was found in matrix-js-sdk up to 23.x. It has been rated as critical. This vulnerability affects unknown code of the component Event Handler. The manipulation leads to prototype pollution. This vulnerability is referenced as CVE-2023-28427. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in matrix-js-sdk up to 23.x. It has been rated as critical. This issue affects an unknown function of the component Event Handler. The manipulation with an unknown input leads to a prototype pollution vulnerability. Using CWE to declare the problem leads to CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Impacted is integrity, and availability. The summary by CVE is:

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was published 03/29/2023 as GHSA-mwq8-fjpf-c2gr. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-28427 since 03/15/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 239763 (TencentOS Server 4: thunderbird (TSSA-2024:0450)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 24.0.0 eliminates this vulnerability. The upgrade is hosted for download at matrix.org.

The vulnerability is also documented in the vulnerability database at Tenable (239763). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• matrix-js-sdk

Version

• 23.x

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion