CVE-2023-41318

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script	Third Party Advisory
https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137	Patch
https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59	Patch
https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:turt2live:matrix-media-repo:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-09-08 20:15

Updated : 2023-09-13 02:17

NVD link : CVE-2023-41318

Mitre link : CVE-2023-41318

CVE.ORG link : CVE-2023-41318

JSON object : View

Products Affected

turt2live

matrix-media-repo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-41318", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "published": "2023-09-08T20:15:14.693", "references": [{"url": "https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround."}, {"lang": "es", "value": "Matrix-media-repo es un repositorio de medios multidominio altamente personalizable para el ecosistema de chat de Matrix. En las versiones afectadas, un atacante podr\u00eda cargar un contenido malicioso en el repositorio de contenidos, que luego se entregar\u00eda con \"Content-Disposition: inline\" al descargarlo. Esta vulnerabilidad podr\u00eda aprovecharse para ejecutar scripts incrustados en contenido SVG. Los commits `77ec235` y `bf8abdd` solucionan el problema y se incluyen en la versi\u00f3n 1.3.0. Los operadores deben actualizar a la versi\u00f3n 1.3.0 lo antes posible. Los operadores que no puedan actualizar deben anular el encabezado \"Content-Disposition\" devuelto por Matrix-media-repo como workaround."}], "lastModified": "2023-09-13T02:17:59.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:turt2live:matrix-media-repo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7900287F-C40A-4E34-A327-C0F6A014AB60", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}