CVE-2023-28427highCWE-1321

CVE-2023-28427: high-severity vulnerability in matrix-org matrix-js-sdk

Prototype pollution in matrix-js-sdk

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 1.2%
exploitation probability
1.2%top 33% of all CVEs
observed exploitation
nono source reports it
In short

A flaw in matrix-js-sdk allows attackers to send specially crafted messages that corrupt or hide data in the application, even though it appears to be working normally. This can cause the app to silently process incorrect information, compromising data integrity.

Technical detail

Prototype pollution vulnerability in matrix-js-sdk versions before 24.0.0 allows remote attackers to inject malicious property names in Matrix protocol events, corrupting runtime object prototypes and causing data exclusion or modification. The attack requires sending crafted messages through the Matrix protocol; impact includes silent data corruption while the SDK appears functional.

Summary generated and translated by AI from the official description.
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
matrix-org · matrix-js-sdk
Related CVEs — matrix-org matrix-js-sdk

In the same product, most dangerous first.

CVE-2022-39236MEDIUMMatrix Javascript SDK improper beacon events can cause availability issuesEPSS 1.3%CVE-2022-39249HIGHMatrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 1.3%CVE-2022-39250HIGHMatrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationEPSS 1.2%CVE-2022-39251HIGHMatrix Javascript SDK vulnerable to Olm/Megolm protocol confusionEPSS 1.2%CVE-2022-36059HIGHPrototype pollution in matrix-js-sdkEPSS 0.9%CVE-2024-50336MEDIUMmatrix-js-sdk has insufficient MXC URI validation which allows client-side path traversalEPSS 0.8%
References
https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-mwq8-fjpf-c2grhttps://lists.debian.org/debian-lts-announce/2023/04/msg00027.htmlhttps://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0https://security.gentoo.org/glsa/202305-36https://www.debian.org/security/2023/dsa-5392