CVE-2023-41318 Unsafe media served inline on download endpoints in matrix-media-repo

2023-09-0819:51:20

CWE-79

GitHub_M

www.cve.org

cve-2023-41318

unsafe media

download endpoints

matrix-media-repo

svg content

content-disposition

upgrade

workaround

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

25.7%

JSON

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits 77ec235 and bf8abdd fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the Content-Disposition header returned by matrix-media-repo as a workaround.

CNA Affected

[
  {
    "vendor": "turt2live",
    "product": "matrix-media-repo",
    "versions": [
      {
        "version": "< 1.3.0",
        "status": "affected"
      }
    ]
  }
]