CVE-2021-32622: Improper file handling in matrix-react-sdk
Summary
CVE-2021-32622: Improper file handling in matrix-react-sdk. Affects matrix-react-sdk versions < 3.21.0. Fixed in 3.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. It provides the functionality to upload files, allowing users to preview and interact with the uploaded files. However, prior to version 3.21.0, there was a vulnerability in the file handling process that could lead to the execution of scripts embedded in the uploaded file. This vulnerability could only be exploited by the local user while in the process of uploading and required several user interactions to open the preview in a separate tab. It could not be exploited remotely or by other users.
Vulnerability Detail
The vulnerability in matrix-react-sdk allowed for the execution of scripts embedded in uploaded files during the local file preview. This means that if a user uploaded a file containing malicious scripts and opened the preview in a separate tab, those scripts could be executed. However, it's important to note that this vulnerability only impacted the local user during the uploading process and could not be exploited remotely or by other users. The vulnerability has been patched in version 3.21.0 of matrix-react-sdk.
How To Fix
Minimum fixed version
3.21.0
This is the first release that contains the fix.
npm install matrix-react-sdk@3.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability in matrix-react-sdk allowed for the execution of scripts embedded in uploaded files during the local file preview. However, this vulnerability could only be exploited by the local user during the uploading process and has been patched in version 3.21.0. It cannot be exploited remotely or by other users. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-react-sdk →
FAQ
No, this vulnerability can only be exploited by the local user during the uploading process.
No, this vulnerability only impacts the local user and cannot be exploited by other users.
The impact of this vulnerability is limited to the local user's system during the uploading process. It cannot be exploited remotely or by other users.
Yes, this vulnerability has been patched in version 3.21.0 of matrix-react-sdk.
To protect yourself from this vulnerability, it is recommended to upgrade to version 3.21.0 or later of matrix-react-sdk.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-react-sdk.
