Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-30609

CVE-2023-30609: HTML injection in search results via plaintext message highlighting

8.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-30609
GHSA ID
GHSA-xv83-x443-7rmw
EPSS Score
0.58961%
CWE
CWE-74
Published
4/25/2023
Updated
11/4/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
matrix-react-sdknpm< 3.71.03.71.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from two key functions: 1) bodyToHtml failed to escape plaintext messages before passing them to the highlighter, as shown in the diff adding escapeHtml(plainBody). 2) applyHighlights' JSDoc explicitly states it requires sanitized input but was receiving raw user-controlled data. The combination allowed HTML injection when plaintext messages containing HTML tags were highlighted in search results. The commit fixes this by adding HTML escaping in bodyToHtml before calling applyHighlights.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Pl*in t*xt m*ss***s *ont*inin* *TML t**s *r* r*n**r** *s *TML in t** s**r** r*sults. To *xploit t*is, *n *tt**k*r n***s to tri*k * us*r into s**r**in* *or * sp**i*i* m*ss*** *ont*inin* *n *TML inj**tion p*ylo**. *ross-sit* s*riptin* is po

Reasoning

T** vuln*r**ility st*mm** *rom two k*y *un*tions: *) `*o*yTo*tml` **il** to *s**p* pl*int*xt m*ss***s ***or* p*ssin* t**m to t** *i**li**t*r, *s s*own in t** *i** ***in* `*s**p**tml(pl*in*o*y)`. *) `*pply*i**li**ts`' JS*o* *xpli*itly st*t*s it r*quir