CVE-2023-30609: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
(updated )
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
References
- github.com/advisories/GHSA-xv83-x443-7rmw
- github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826
- github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0
- github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw
- nvd.nist.gov/vuln/detail/CVE-2023-30609
Code Behaviors & Features
Detect and mitigate CVE-2023-30609 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →