Executive brief
matrix-react-sdk is a JavaScript SDK used to build Matrix chat clients. A prototype pollution vulnerability allows remote servers to send malicious data that corrupts JavaScript object prototypes, causing the SDK to malfunction, crash, or behave unexpectedly. This could disrupt chat functionality, cause denial of service, or allow attackers to manipulate application logic.
Technical details
A prototype pollution vulnerability (CWE-1321) in matrix-react-sdk allows remote servers to inject specially crafted strings in object keys that modify Object.prototype. The vulnerability is triggered when the SDK processes data from remote Matrix servers without properly validating or sanitizing object keys, allowing attackers to pollute the JavaScript prototype chain. Attack vector is network-based with no authentication required. Exploitation can cause application crashes, disruption of chat rendering, denial of service, and potentially affect program logic. Patches are available in matrix-react-sdk 3.69.0 (for GHSA-6g43-88cp-w5gv / CVE-2023-28103) and 3.53.0 (for the related GHSA-2x9c-qwgf-94xr / CVE-2022-36060).
Affected products
- Matrix matrix-react-sdk < 3.69.0
Timeline
- 2023-03-28: disclosed
- 2023-03-29: advisory: GHSA-6g43-88cp-w5gv (CVE-2023-28103) published; covers part 2 of prototype pollution issues
- 2023-03-28: patched: Fixed in matrix-react-sdk 3.69.0