Skip to main content

Unrestricted Upload of File with Dangerous Type

CVE-2021-32622

High
7.8/10

Summary

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0-rc.1, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0-rc.1.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • HIGH

CWE-434 - Unrestricted Upload of File with dangerous type

'Unrestricted file upload with dangerous type' attacks involve an attacker uploading or transferring files of dangerous types to the server. The severity of such an attack depends upon the execution mechanism and the storage location of the uploaded file. Thus, it may range from simple defacement to arbitrary file execution, and complete system takeover.

References

Advisory Timeline

  • Published