Prototype pollution in matrix-react-sdk

Vulnerability

CVE-2023-28103 is a prototype pollution vulnerability in matrix-react-sdk, the React-based SDK used by Element Web/Desktop and Cinny. In certain configurations, data sent by remote servers containing special strings in key locations can modify Object.prototype, disrupting normal SDK functionality [1][2][3]. This is the second part of a pair of similar issues; the first part (CVE-2022-36060) was patched in matrix-react-sdk 3.53.0 but disclosed only after a subsequent codebase audit identified the remaining vectors addressed by this CVE [4].

Exploitation

An attacker controlling a Matrix server can craft events with specially crafted keys that, when processed by a vulnerable client, lead to prototype pollution. No user interaction beyond receiving the malicious event is required; the attack surface is the normal server-client communication channel [2][3].

Impact

Successful exploitation causes denial of service by temporarily disrupting SDK functionality. While the Matrix.org advisory classifies this as High severity and notes that only a DoS impact has been demonstrated, prototype pollution can potentially affect program logic and the ability to process data safely. The advisory explicitly does not rule out a more severe impact [3].

Mitigation

The vulnerability is fixed in matrix-react-sdk version 3.69.0. Users of affected clients (Element Web/Desktop, Cinny, and others) are advised to upgrade without delay. No workarounds exist [2][3][4].