CVE-2023-28103: matrix-org matrix-react-sdk Prototype Pollution

Vulnerability summary

CVE-2023-28103 is a high (CVSS 8.2) Prototype Pollution vulnerability in matrix-org matrix-react-sdk. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities.

Timeline

1. 28-03-2023
   PublishedVulnerability first disclosed.
2. 18-02-2025
   Last modifiedVulnerability information updated.

Description

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is fixed in matrix-react-sdk 3.69.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Note this advisory is distinct from GHSA-2x9c-qwgf-94xr which refers to a similar issue.

• CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.