Is CVE-2023-37259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-37259 being exploited in the wild.

How severe is CVE-2023-37259?

Low severity, with a CVSS score of 3.1, published 18 July 2023.

Which products and versions are affected?

matrix-react-sdk (npm) SEMVER:introduced=3.32.0,fixed=3.76.0.

Is there a fix for CVE-2023-37259?

Yes. matrix-react-sdk (npm): upgrade to 3.76.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-37259 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2023-37259?

Check whether you run matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-37259: matrix-react-sdk XSS in Export Chat feature

CVE-2023-37259 · Severity: low · CVSS 3.1 · Published 2023-07-18

matrix-react-sdk is a JavaScript library that powers the Element messaging client's web interface. The Export Chat feature allows users to download conversation history, but fails to properly escape attacker-controlled content, enabling stored cross-site scripting (XSS) attacks. A malicious Matrix server can inject malicious code into exported chats to potentially leak private message contents.

Technologies: matrix-react-sdk (npm). Vendors: npm.

Quick answers

Is CVE-2023-37259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-37259 being exploited in the wild.
How severe is CVE-2023-37259?: Low severity, with a CVSS score of 3.1, published 18 July 2023.
Which products and versions are affected?: matrix-react-sdk (npm) SEMVER:introduced=3.32.0,fixed=3.76.0.
Is there a fix for CVE-2023-37259?: Yes. matrix-react-sdk (npm): upgrade to 3.76.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-37259 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2023-37259?: Check whether you run matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-react-sdk (npm): upgrade to 3.76.0 or later
```
npm install matrix-react-sdk@3.76.0
```

Technical details

The vulnerability is a stored XSS (CWE-79/80) in the Export Chat feature of matrix-react-sdk versions 3.32.0 through 3.75.x. The export function generates an HTML document but does not adequately escape attacker-controlled elements such as user display names or message content sourced from the Matrix homeserver. An attacker controlling a Matrix homeserver can inject arbitrary HTML/JavaScript into exported chat files. While the injected code runs in a sandboxed context (null origin), it can still be leveraged to exfiltrate message contents. The vulnerability requires user interaction (triggering the export function) and some level of privilege (malicious homeserver). This was patched in matrix-react-sdk 3.76.0.

Affected products

Matrix.org matrix-react-sdk 3.32.0 to 3.75.x

Identifiers

CVE-2023-37259
GHSA-c9vx-2g7w-rp65

Timeline

2023-07-18: disclosed
2023-07-18: patched: Fixed in matrix-react-sdk 3.76.0

References

https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.