Is CVE-2022-36059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-36059 being exploited in the wild.

How severe is CVE-2022-36059?

Low severity, with a CVSS score of 3.1, published 28 March 2023.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.4.0.

Is there a fix for CVE-2022-36059?

Yes. matrix-js-sdk (npm): upgrade to 19.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-36059 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-36059?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-36059: matrix-js-sdk prototype pollution in event processing

CVE-2022-36059 · Severity: low · CVSS 3.1 · Published 2023-03-28

matrix-js-sdk is a JavaScript library that enables applications to communicate using the Matrix protocol. A prototype pollution vulnerability allows attackers to inject malicious event data that can corrupt runtime data, disrupt the SDK's operation, or exclude information from being processed correctly. This could cause a Matrix client built on this library to malfunction, lose data, or stop responding to user actions.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2022-36059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-36059 being exploited in the wild.
How severe is CVE-2022-36059?: Low severity, with a CVSS score of 3.1, published 28 March 2023.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.4.0.
Is there a fix for CVE-2022-36059?: Yes. matrix-js-sdk (npm): upgrade to 19.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-36059 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-36059?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 19.4.0 or later
```
npm install matrix-js-sdk@19.4.0
```

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in matrix-js-sdk versions before 19.4.0 that allows modification of JavaScript object prototypes through specially crafted event data. An attacker can send events with special strings in key places that pollute the prototype chain, causing the SDK to exclude or corrupt runtime data. The attack is network-accessible, requires no authentication or user interaction, and can impact the availability and integrity of the SDK's data processing. The vulnerability is fixed in version 19.4.0. Workarounds include redacting affected events, restarting the client, or clearing storage, though some cases may not be fully recoverable without the patch.

Affected products

matrix-org matrix-js-sdk < 19.4.0

Identifiers

CVE-2022-36059
GHSA-rfv9-x7hh-xc32

Timeline

2023-03-28: disclosed
2023-03-28: patched: Fix available in version 19.4.0

References

https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.