CVE-2023-30609: Matrix React SDK HTML injection in search results

CVE-2023-30609 · Severity: low · CVSS 3.1 · Published 2023-04-25

Matrix React SDK is a JavaScript library that powers Matrix chat client interfaces. When users search for messages, plaintext messages containing HTML tags are incorrectly rendered as active HTML in the search results, allowing attackers to inject malicious scripts. An attacker can trick a user into searching for a specially crafted message to execute cross-site scripting (XSS) attacks and steal data or compromise the user's account.

Technologies: Matrix.org React SDK, matrix-react-sdk (npm). Vendors: Matrix.org, npm.

Quick answers

Is CVE-2023-30609 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-30609 being exploited in the wild.
How severe is CVE-2023-30609?
Low severity, with a CVSS score of 3.1, published 25 April 2023.
Which products and versions are affected?
Matrix.org React SDK <= 3.70.0; matrix-react-sdk (npm) SEMVER:introduced=0,fixed=3.71.0.
Is there a fix for CVE-2023-30609?
Yes. matrix-react-sdk (npm): upgrade to 3.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-30609 attacked?
It is attacked over the network.
Am I affected by CVE-2023-30609?
Check whether you run Matrix.org React SDK or matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-react-sdk (npm): upgrade to 3.71.0 or later
    npm install matrix-react-sdk@3.71.0

Technical details

The vulnerability is an HTML injection / cross-site scripting (CWE-74, CWE-79) in the search results display logic. When rendering search results, the SDK fails to properly sanitize or escape HTML entities in plaintext messages, causing HTML tags to be interpreted as markup rather than literal text. The attack requires authentication (PR:L) and user interaction (UI:R) to lure a victim into searching for the payload. However, the scope changes (S:C), affecting resources outside the search component. An attacker can inject resources from recaptcha.net and gstatic.com (domains whitelisted in the default CSP) to perform stored XSS. The issue is fixed in version 3.71.0; users can temporarily work around it by restarting the client.

Affected products

  • Matrix.org React SDK <= 3.70.0

Identifiers

  • CVE-2023-30609
  • GHSA-xv83-x443-7rmw

Timeline

  • 2023-04-25: disclosed
  • 2023-04-25: patched: Version 3.71.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.