CVE-2023-30609: matrix-org matrix-react-sdk Injection

Vulnerability summary

CVE-2023-30609 is a medium (CVSS 5.4) Injection vulnerability in matrix-org matrix-react-sdk. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.5% of scored vulnerabilities.

Timeline

1. 25-04-2023
   PublishedVulnerability first disclosed.
2. 03-02-2025
   Last modifiedVulnerability information updated.

Description

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.