HTML injection in search results via plaintext message highlighting

中 4.7CVE-2023-30609 · GHSA-xv83-x443-7rmw · 25/04/2023 公開 · 17/06/2026 更新

要点

CVE-2023-30609 は matrix-react-sdk (matrix-react-sdk project), matrix-react-sdk に影響する深刻度「中」 (CVSS 4.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.62%（全脆弱性の 49.6% より高い）。
対処：3.71.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
matrix-react-sdk matrix-react-sdk_project	`< 3.71.0`	`3.71.0`
matrix-react-sdk npm	`< 3.71.0`	`3.71.0`

概要

Impact

Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.

Cross-site scripting is possible by including resources from recaptcha.net and gstatic.com which are included in the default CSP.

Thanks to Cadence Ember for finding the injection and to S1m for finding possible XSS vectors.

Patches

Version 3.71.0 of the SDK fixes the issue.

Workarounds

Restarting the client will clear the injection.

NVD の説明

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.