Headline
CVE-2023-41318: Unsafe media served inline on download endpoints
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits 77ec235 and bf8abdd fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the Content-Disposition header returned by matrix-media-repo as a workaround.
Impact
A malicious user can upload an SVG image containing JavaScript to their server. When matrix-media-repo is asked to serve that media via the /_matrix/media/(r0|v3)/download endpoint, it would be served with a Content-Disposition of inline. This can allow JavaScript to run in the browser if a client links to the /download endpoint directly.
Server operators which do not share a domain between matrix-media-repo and other services are not affected, but are encouraged to upgrade regardless.
Patches
77ec235 and bf8abdd fix the issue. Operators should upgrade to v1.3.0 as soon as possible.
Workarounds
The Content-Disposition header can be overridden by the reverse proxy in front of matrix-media-repo to always use attachment, defeating this issue at the cost of “worse” user experience when clicking download links.
References
https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script
Related news
### Impact A malicious user can upload an SVG image containing JavaScript to their server. When matrix-media-repo is asked to serve that media via the `/_matrix/media/(r0|v3)/download` endpoint, it would be served with a `Content-Disposition` of `inline`. This can allow JavaScript to run in the browser if a client links to the `/download` endpoint directly. Server operators which do not share a domain between matrix-media-repo and other services are not affected, but are encouraged to upgrade regardless. ### Patches https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137 and https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59 fix the issue. Operators should upgrade to v1.3.0 as soon as possible. ### Workarounds The `Content-Disposition` header can be overridden by the reverse proxy in front of matrix-media-repo to always use `attachment`, defeating this issue at the cost of "worse" user experience when...