Is CVE-2023-28427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-28427 being exploited in the wild.

How severe is CVE-2023-28427?

Low severity, with a CVSS score of 3.1, published 30 March 2023.

Which products and versions are affected?

matrix-js-sdk (npm) SEMVER:introduced=0,fixed=24.0.0.

Is there a fix for CVE-2023-28427?

Yes. matrix-js-sdk (npm): upgrade to 24.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-28427 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-28427?

Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-28427: matrix-js-sdk prototype pollution (part 2)

CVE-2023-28427 · Severity: low · CVSS 3.1 · Published 2023-03-30

matrix-js-sdk is a JavaScript library used by Matrix chat clients to communicate with Matrix servers. A prototype pollution vulnerability allows remote servers to send specially crafted data that corrupts the library's runtime behavior, causing the client to malfunction, lose data, or crash. Attackers do not need user interaction or authentication to trigger this flaw.

Technologies: matrix-js-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2023-28427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-28427 being exploited in the wild.
How severe is CVE-2023-28427?: Low severity, with a CVSS score of 3.1, published 30 March 2023.
Which products and versions are affected?: matrix-js-sdk (npm) SEMVER:introduced=0,fixed=24.0.0.
Is there a fix for CVE-2023-28427?: Yes. matrix-js-sdk (npm): upgrade to 24.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-28427 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-28427?: Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-js-sdk (npm): upgrade to 24.0.0 or later
```
npm install matrix-js-sdk@24.0.0
```

Technical details

This is a prototype pollution vulnerability (CWE-1321) in matrix-js-sdk where object initialization routines fail to guard against keys that modify Object.prototype. Remote Matrix servers can send malicious events containing special strings in key locations, triggering object property assignments that pollute the prototype chain. No authentication or user interaction is required; a network-reachable attacker server is sufficient. Exploitation causes denial of service, data corruption, and disruption of SDK functionality. The issue was patched in version 24.0.0; version 19.4.0 addressed an initial set of vulnerable code paths discovered in a prior audit.

Affected products

matrix.org matrix-js-sdk < 24.0.0

Identifiers

CVE-2023-28427
GHSA-mwq8-fjpf-c2gr

Timeline

2023-03-28: disclosed: GHSA-mwq8-fjpf-c2gr published (part 2 of prototype pollution issues)
2023-03-28: patched: matrix-js-sdk 24.0.0 released with fix
2023-03-30: other: Advisory indexed in OSV database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.