Executive brief
Matrix React SDK is a JavaScript library that powers the user interface of Matrix chat applications. When users upload files, the local preview feature can execute malicious scripts embedded in those files, but only after the user explicitly opens the preview in a separate tab. This allows an attacker to run unauthorized code on the uploading user's machine during the file upload process, potentially stealing session tokens or local data.
Technical details
The vulnerability is a cross-site scripting (XSS) issue in the file upload local preview functionality of matrix-react-sdk (CWE-74). Malicious scripts embedded in uploaded files can be executed in the browser context, but exploitation requires multiple user interactions: the attacker must craft a malicious file, the user must upload it, and then the user must explicitly open the preview in a separate browser tab. The attack is limited to the local uploading user's session and cannot be exploited remotely or affect other users. The vulnerability was fixed in version 3.21.0 by pull request #5981.
Affected products
- Matrix.org React SDK < 3.21.0
Timeline
- 2021-05-17: disclosed