Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-32622

CVE-2021-32622:
Improper file handling in matrix-react-sdk

4.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-32622
GHSA ID
GHSA-cg57-p69r-3m7p
EPSS Score
0.395%
CWE
CWE-74
Published
2/10/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
matrix-react-sdknpm< 3.21.03.21.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers on unsafe local file preview handling. While exact patch details aren't available, the advisory indicates previews in separate tabs could execute scripts. This suggests functions handling: 1) Preview window creation (using window.open() with blob: or about:blank targets) 2) File content rendering in new windows 3) Unsafe HTML injection patterns. The medium confidence reflects educated guesses based on React file preview patterns and CWE-74/434 characteristics, though without seeing the actual #5981 patch code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M*trix-R***t-S*K is * r***t-**s** S*K *or ins*rtin* * M*trix ***t/voip *li*nt into * w** p***. ***or* v*rsion *.**.*, w**n uplo**in* * *il*, t** lo**l *il* pr*vi*w **n l*** to *x**ution o* s*ripts *m****** in t** uplo**** *il*. T*is **n only o**ur **

Reasoning

T** vuln*r**ility **nt*rs on uns*** lo**l *il* pr*vi*w **n*lin*. W*il* *x**t p*t** **t*ils *r*n't *v*il**l*, t** **visory in*i**t*s pr*vi*ws in s*p*r*t* t**s *oul* *x**ut* s*ripts. T*is su***sts *un*tions **n*lin*: *) Pr*vi*w win*ow *r**tion (usin* `