Is CVE-2023-28103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-28103 being exploited in the wild.

How severe is CVE-2023-28103?

Low severity, with a CVSS score of 3.1, published 29 March 2023.

Which products and versions are affected?

matrix-react-sdk (npm) SEMVER:introduced=0,fixed=3.69.0.

Is there a fix for CVE-2023-28103?

Yes. matrix-react-sdk (npm): upgrade to 3.69.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-28103 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-28103?

Check whether you run matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-28103: Matrix matrix-react-sdk prototype pollution

CVE-2023-28103 · Severity: low · CVSS 3.1 · Published 2023-03-29

matrix-react-sdk is a JavaScript SDK used to build Matrix chat clients. A prototype pollution vulnerability allows remote servers to send malicious data that corrupts JavaScript object prototypes, causing the SDK to malfunction, crash, or behave unexpectedly. This could disrupt chat functionality, cause denial of service, or allow attackers to manipulate application logic.

Technologies: matrix-react-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2023-28103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-28103 being exploited in the wild.
How severe is CVE-2023-28103?: Low severity, with a CVSS score of 3.1, published 29 March 2023.
Which products and versions are affected?: matrix-react-sdk (npm) SEMVER:introduced=0,fixed=3.69.0.
Is there a fix for CVE-2023-28103?: Yes. matrix-react-sdk (npm): upgrade to 3.69.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-28103 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-28103?: Check whether you run matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-react-sdk (npm): upgrade to 3.69.0 or later
```
npm install matrix-react-sdk@3.69.0
```

Technical details

A prototype pollution vulnerability (CWE-1321) in matrix-react-sdk allows remote servers to inject specially crafted strings in object keys that modify Object.prototype. The vulnerability is triggered when the SDK processes data from remote Matrix servers without properly validating or sanitizing object keys, allowing attackers to pollute the JavaScript prototype chain. Attack vector is network-based with no authentication required. Exploitation can cause application crashes, disruption of chat rendering, denial of service, and potentially affect program logic. Patches are available in matrix-react-sdk 3.69.0 (for GHSA-6g43-88cp-w5gv / CVE-2023-28103) and 3.53.0 (for the related GHSA-2x9c-qwgf-94xr / CVE-2022-36060).

Affected products

Matrix matrix-react-sdk < 3.69.0

Identifiers

CVE-2023-28103
GHSA-6g43-88cp-w5gv

Timeline

2023-03-28: disclosed
2023-03-29: advisory: GHSA-6g43-88cp-w5gv (CVE-2023-28103) published; covers part 2 of prototype pollution issues
2023-03-28: patched: Fixed in matrix-react-sdk 3.69.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.