Executive brief
matrix-js-sdk is a JavaScript library that enables applications to communicate using the Matrix protocol. A prototype pollution vulnerability allows attackers to inject malicious event data that can corrupt runtime data, disrupt the SDK's operation, or exclude information from being processed correctly. This could cause a Matrix client built on this library to malfunction, lose data, or stop responding to user actions.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in matrix-js-sdk versions before 19.4.0 that allows modification of JavaScript object prototypes through specially crafted event data. An attacker can send events with special strings in key places that pollute the prototype chain, causing the SDK to exclude or corrupt runtime data. The attack is network-accessible, requires no authentication or user interaction, and can impact the availability and integrity of the SDK's data processing. The vulnerability is fixed in version 19.4.0. Workarounds include redacting affected events, restarting the client, or clearing storage, though some cases may not be fully recoverable without the patch.
Affected products
- matrix-org matrix-js-sdk < 19.4.0
Timeline
- 2023-03-28: disclosed
- 2023-03-28: patched: Fix available in version 19.4.0