CVE-2023-37259: Cross site scripting in Export Chat feature
Description
The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS.
Impact
Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restricting the impact.
However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side.
Patches This was patched in matrix-react-sdk 3.76.0.
Workarounds None, other than not using the Export Chat feature.
References N/A
Other sources
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit 22fcd34c60 which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/matrix-react-sdkto a version that resolves this vulnerability.Fixed in 3.76.0 - Upgrade
Upgrade
matrix-react-sdkto a version that resolves this vulnerability.Fixed in 3.76.0Patch 22fcd34c60 - Configuration
Disable or do not use the Export Chat feature as the workaround for the stored XSS vulnerability.
matrix-react-sdk Export Chat feature use_export_chat = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37259?
CVE-2023-37259 is considered a high severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2023-37259?
To fix CVE-2023-37259, you should update the Matrix React SDK to version 3.76.0 or later.
What is stored XSS in the context of CVE-2023-37259?
Stored XSS in CVE-2023-37259 refers to the ability of an attacker to inject malicious scripts into generated documents via the Export Chat feature.
Which versions of the Matrix React SDK are affected by CVE-2023-37259?
CVE-2023-37259 affects Matrix React SDK versions between 3.32.0 and 3.76.0, inclusive.
Can CVE-2023-37259 affect user data security?
Yes, CVE-2023-37259 can compromise user data security by allowing attackers to execute scripts within the context of a user's session.