CVE-2023-41318

Summary

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits 77ec235 and bf8abdd fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the Content-Disposition header returned by matrix-media-repo as a workaround.

Affected Software

Weaknesses

• CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72
• https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137
• https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59
• https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72
• https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137
• https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59
• https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

• ←Previous
• Next→