GitHub Advisoryadvisory · npm

GHSA-xv83-x443-7rmw HTML injection in search results via plaintext message highlighting

HIGH Published 2023-04-25 Modified 2023-09-22 Official page ↗
Aliases
CVE-2023-30609
Ecosystem
npm
Packages
matrix-react-sdk
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Weaknesses
CWE-74, CWE-79
Reviewed
2023-04-25

Affected packages

• npm matrix-react-sdk: < 3.71.0 → fixed in 3.71.0

Description

Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. Cross-site scripting is possible by including resources from `recaptcha.net` and `gstatic.com` which are included in the default CSP. Thanks to Cadence Ember for finding the injection and to S1m for finding possible XSS vectors. Patches Version 3.71.0 of the SDK fixes the issue. Workarounds Restarting the client will clear the injection.

Related

Alias · CVE (1)

  • CVE-2023-30609 matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References