CVE-2023-30609: matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.
Cross-site scripting is possible by including resources from recaptcha.net and gstatic.com which are included in the default CSP.
Thanks to Cadence Ember for finding the injection and to S1m for finding possible XSS vectors.
Patches Version 3.71.0 of the SDK fixes the issue.
Workarounds Restarting the client will clear the injection.
Other sources
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30609?
CVE-2023-30609 is considered a medium severity vulnerability due to potential cross-site scripting attacks.
How can I fix CVE-2023-30609?
To fix CVE-2023-30609, upgrade to matrix-react-sdk version 3.71.0 or later.
What type of attack is possible with CVE-2023-30609?
CVE-2023-30609 allows for cross-site scripting attacks by rendering plain text messages with HTML tags in search results.
Which software is affected by CVE-2023-30609?
CVE-2023-30609 affects versions of the matrix-react-sdk prior to 3.71.0.
What methods can an attacker use to exploit CVE-2023-30609?
An attacker can exploit CVE-2023-30609 by tricking a user into searching for a specific message that contains an HTML injection payload.