PT-2023-21561 · Unknown · Matrix-React-Sdk

Denis Kasak · Publicado 2023-03-28 · Atualizado 2023-04-05 · CVE-2023-28103

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions matrix-react-sdk versions prior to 3.69.0

Description The issue arises when data sent by remote servers contains special strings in key locations, potentially modifying the Object.prototype and disrupting the functionality of matrix-react-sdk, leading to denial of service and affecting program logic.

Recommendations For versions prior to 3.69.0, upgrade to version 3.69.0 to resolve the issue. As a temporary workaround, consider restricting the handling of data from remote servers to prevent modifications of the Object.prototype until a patch is available.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2023-28103

GHSA-6G43-88CP-W5GV

Produtos afetados

Matrix-React-Sdk

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28103.json · Exploit
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv · Aviso do Fabricante
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr · Nota
• https://github.com/matrix-org/matrix-react-sdk · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28103 · Nota de Segurança
• https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 · Aviso do Fabricante
• https://t.me/cvenotify/47551 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28103 · Aviso do Fabricante
• https://t.me/cibsecurity/60969 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-6g43-88cp-w5gv · Aviso do Fabricante