GHSA-xv83-x443-7rmw — high GitHub Advisory (CVE-2023-30609) in npm/matrix-react-sdk

Description

Impact

Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.

Cross-site scripting is possible by including resources from recaptcha.net and gstatic.com which are included in the default CSP.

Thanks to Cadence Ember for finding the injection and to S1m for finding possible XSS vectors.

Patches

Version 3.71.0 of the SDK fixes the issue.

Workarounds

Restarting the client will clear the injection.

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2023-04-25 19:48:11 UTC
Updated: 2023-11-04 05:04:33 UTC
GitHub reviewed: 2023-04-25 19:48:11 UTC
NVD published: 2023-04-25

Score	Percentile
0.49%	64.91%

CVSS Scores

Base score	Version	Severity	Vector
8.2	3.1	—	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.

Identifiers

Type	Value
GHSA	GHSA-xv83-x443-7rmw ↗
CVE	CVE-2023-30609 ↗

CWEs

CWE id	Name
CWE-74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
npm	matrix-react-sdk	< 3.71.0	3.71.0	—

HTML injection in search results via plaintext message highlighting