PT-2023-21561 · Unknown · Matrix-React-Sdk

Denis Kasak · Published 2023-03-28 · Updated 2023-04-05 · CVE-2023-28103

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions matrix-react-sdk versions prior to 3.69.0

Description The issue arises when data sent by remote servers contains special strings in key locations, potentially modifying the Object.prototype and disrupting the functionality of matrix-react-sdk, leading to denial of service and affecting program logic.

Recommendations For versions prior to 3.69.0, upgrade to version 3.69.0 to resolve the issue. As a temporary workaround, consider restricting the handling of data from remote servers to prevent modifications of the Object.prototype until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-28103

GHSA-6G43-88CP-W5GV

Affected Products

Matrix-React-Sdk

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28103.json · Exploit
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-6g43-88cp-w5gv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28103 · Security Note
• https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28103 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6g43-88cp-w5gv · Vendor Advisory
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr · Note
• https://github.com/matrix-org/matrix-react-sdk · Note
• https://t.me/cvenotify/47551 · Telegram Post
• https://t.me/cibsecurity/60969 · Telegram Post