Executive brief
matrix-js-sdk is a JavaScript library used by Matrix chat clients to communicate with Matrix servers. A prototype pollution vulnerability allows remote servers to send specially crafted data that corrupts the library's runtime behavior, causing the client to malfunction, lose data, or crash. Attackers do not need user interaction or authentication to trigger this flaw.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in matrix-js-sdk where object initialization routines fail to guard against keys that modify Object.prototype. Remote Matrix servers can send malicious events containing special strings in key locations, triggering object property assignments that pollute the prototype chain. No authentication or user interaction is required; a network-reachable attacker server is sufficient. Exploitation causes denial of service, data corruption, and disruption of SDK functionality. The issue was patched in version 24.0.0; version 19.4.0 addressed an initial set of vulnerable code paths discovered in a prior audit.
Affected products
- matrix.org matrix-js-sdk < 24.0.0
Timeline
- 2023-03-28: disclosed: GHSA-mwq8-fjpf-c2gr published (part 2 of prototype pollution issues)
- 2023-03-28: patched: matrix-js-sdk 24.0.0 released with fix
- 2023-03-30: other: Advisory indexed in OSV database