GitHub Advisoryadvisory · npm

GHSA-c9vx-2g7w-rp65 matrix-react-sdk vulnerable to XSS in Export Chat feature

MEDIUM Published 2023-07-18 Modified 2023-07-19 Official page ↗
Aliases
CVE-2023-37259
Ecosystem
npm
Packages
matrix-react-sdk
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2023-07-18

Affected packages

• npm matrix-react-sdk: >= 3.32.0, < 3.76.0 → fixed in 3.76.0

Description

Description The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS. Impact Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. Patches This was patched in matrix-react-sdk 3.76.0. Workarounds None, other than not using the Export Chat feature. References N/A

Related

Alias · CVE (1)

  • CVE-2023-37259 matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References