CVE-2022-36060

Executive Summary

CVE-2022-36060 is a prototype pollution vulnerability affecting the matrix-react-sdk, a React JavaScript library used to build Matrix chat protocol clients. An attacker who can send messages containing specially crafted strings in key event fields can trigger temporary disruption or complete failure of room and event tile rendering, resulting in a denial-of-service condition localized to specific rooms or events. The vulnerability has been patched in matrix-react-sdk 3.53.0; users are advised to upgrade immediately, as no workarounds exist.

Technical Analysis

The vulnerability class is prototype pollution (CWE-1321), a JavaScript-specific flaw that occurs when an attacker is able to inject properties into the Object.prototype of the application's runtime environment. This is particularly impactful in the matrix-react-sdk, a widely used library underpinning Matrix chat clients, because it processes untrusted user-generated content — namely, event data received from federated Matrix homeservers.

Attack surface: Matrix events (messages, state events, reactions, etc.) are transmitted via homeservers and rendered client-side by the SDK. Event objects contain user-controllable keys such as sender identifiers, message body strings, and custom event fields. The NVD description notes that "special strings in key places" are the trigger vector — meaning certain characters or key-value path patterns within event data are processed by the SDK in a way that pollutes the global object prototype.

Mechanism (class-level): A prototype pollution vulnerability typically arises when an application merges or copies untrusted objects without validating property keys. If a key like __proto__, constructor.prototype, or prototype is present in the untrusted input, and the merge/assignment operation uses a naive recursive algorithm, the attacker-controlled properties are written to Object.prototype. Subsequent property lookups across the entire application inherit the polluted properties, breaking expected behavior.

Specific impact in matrix-react-sdk: The SDK's rendering pipeline constructs React components (room tiles, event tiles) whose behavior depends on property reads from event objects. If the prototype is polluted with malicious values, these reads return unexpected types (e.g., strings instead of undefined, functions instead of booleans), causing React rendering logic to throw exceptions or enter inconsistent states. The description states that "certain rooms/events will not be rendered" while "the remainder of the application can appear functional" — consistent with a localized crash condition where the SDK's error boundary fails per-component.

Version scope: All versions prior to 3.53.0 are affected. The fix was released in 3.53.0; the NVD description explicitly states "There are no known workarounds for this vulnerability," indicating a code-level fix was required rather than a configuration change.

Note: Insufficient technical detail is available in the NVD description to identify the exact function names, validation routines, or event fields that serve as the pollution sink. The attack requires the attacker to have the ability to send messages or events that reach the SDK — which, in most Matrix deployments, means being a user in the same room or knowing the target's room membership.

Exploitation Scenarios

The attack chain is inferred entirely from the vulnerability class and the NVD description. No public PoC exists, and no specific trigger payload is documented.

Step 1 — Reconnaissance/Target Identification: The attacker must first identify a target running a vulnerable version (prior to 3.53.0) of any Matrix client built on matrix-react-sdk. This includes the official Element Web client (self-hosted or cloud) and any third-party client or embedded widget using the SDK. The attacker joins or must already be a member of a room in which the target is present. In many Matrix deployments, rooms are invitation-only, but public rooms give the attacker immediate access to potential victims.

Step 2 — Triggering the Flaw: The attacker constructs a Matrix event (a message, a state event, or even a redaction) containing a property key or string that, when processed by the SDK's event-handling/merge logic, causes prototype pollution. Based on the CNA title, the "special strings" likely appear in key-value positions where the SDK performs object merges or deep copies — e.g., a message body, a custom m.relates_to field, or a state event key. A working payload would include a key like __proto__ at a traversal path that the SDK's internal merge function follows.

Step 3 — Payload Execution: The malicious event is broadcast to the room. All connected clients using the vulnerable SDK process the event. The prototype pollution does not give the attacker code execution directly; instead, it injects properties into the global prototype that corrupt subsequent property reads. For example, if a property like isOwnEvent or a rendering flag is polluted to a non-boolean value, React component logic branches incorrectly, causing a render exception. The exception may be caught by React error boundaries, resulting in the event tile being blanked, or it may propagate and freeze the entire room timeline.

Step 4 — Post-Exploitation Impact: The primary impact is a denial-of-service (CVSS availability subscore: 0.87, equivalent to High). Target users cannot view the affected room — the room timeline appears broken with missing events, or in severe cases the entire room fails to render. The description notes "the remainder of the application can appear functional," meaning navigation, other rooms, and settings still work, but the target is socially blocked from communicating in the affected room. If the attacker floods multiple rooms or targets a high-traffic room, they can effectively segment the target from their teams or communities.

Attack-chain summary: Send malicious event → SDK merges event data → prototype polluted → React render crashes → room/event tiles fail to display → denial-of-service for the target user.

Additional consideration: Because prototype pollution persists across the entire JS runtime, the injected properties may survive until the page is refreshed. If the target client stays open, the pollution can disrupt other rooms or features that perform property lookups on keys that were polluted, widening the blast radius beyond the single room.

Impact Assessment

CVSS 8.2 (High) — The score reflects:

• Attack vector: Network — exploitation occurs via standard Matrix federation/message delivery.
• Attack complexity: Low — requiring only crafted strings in event fields.
• Privileges required: None — any room member can send a malicious event.
• User interaction: Required — the victim's client must be open and connected to the affected room to process the event.
• Scope: Changed — the prototype pollution impacts the entire client-side application, not just the script that parsed the event.
• Confidentiality impact: None — no data exfiltration.
• Integrity impact: Low — the polluted properties could temporarily alter displayed data if they affect rendering flags.
• Availability impact: High — the denial-of-service on room/event rendering is the core impact.

Business impact:

• For organizations using Matrix for internal communications (Element or custom clients): an attacker inside a shared room (employee, partner, or infiltrated account) can silence specific individuals, blocking them from incident-response channels or management conversations, which may have operational safety implications.
• For SaaS providers hosting Matrix clients: a single malicious actor could degrade service for many users across shared rooms, damaging reliability reputation and triggering support overhead.
• For developers: if an organization's custom Matrix-based application surfaces event data into other contexts (e.g., forwarding to analytics, bots, or web widgets), the polluted prototype could propagate beyond the SDK to other application logic.

Blast radius: Any client using matrix-react-sdk < 3.53.0. Given the SDK's widespread adoption (Element Web is the reference Matrix client), the affected population is significant. However, EPSS score is 0.00906 (56.5th percentile), indicating low exploit-activity likelihood to date. CISA KEV does not list this CVE, and there is no evidence of in-the-wild exploitation campaigns.

Detection Guidance

The following detection rules target the event content characteristics and client-side behavior that would appear during exploitation, based on the vulnerability class. Note: since a public PoC does not exist, these rules should be treated as heuristics for suspicious event patterns, not definitive proof of exploitation.

Sigma Rule

title: Matrix Event with Prototype Pollution Indicators
id: 2bd9f4a7-6c82-4e55-9ad0-5d2b5eb4c99e
status: experimental
description: Detects Matrix events containing property keys or string patterns commonly used for prototype pollution attempts in matrix-react-sdk.
logsource:
  category: application
  product: matrix
  service: homeserver
detection:
  selection_pollution_keys:
    - event.content.body|contains|all:
        - '__proto__'
        - 'constructor'
    - event.content.relates_to|contains:
        - '__proto__'
        - 'prototype'
  selection_special_strings:
    - event.content.body|contains: '{"__proto__'
  condition: selection_pollution_keys or selection_special_strings
  timeframe: 1h
level: high
falsepositives:
  - Legitimate discussion of prototype pollution in developer rooms
  - Non-malicious events that happen to contain these strings in prose
fields:
  - event.sender
  - event.room_id
  - event.type
  - event.origin_server_ts
tags:
  - attack.t1499
  - cve.2022-36060
  - cwe.1321

YARA Rule

rule Matrix_React_SDK_Prototype_Pollution_CVE_2022_36060
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects JSON payloads containing prototype pollution indicator keys targeting matrix-react-sdk"
        cve = "CVE-2022-36060"
        cwe = "CWE-1321"
        severity = "high"
    strings:
        $key_proto = "__proto__"
        $key_constructor = "constructor"
        $key_prototype = ".prototype."
        $json_open = "{\""
        $colon = ":"
    condition:
        any of ($key*) and #json_open > 2 and #colon > 3
}

Suricata IDS Rule

alert http any any -> any any (msg:"Potential Matrix prototype pollution attempt (CVE-2022-36060)"; flow:to_server,established; content:"__proto__"; http_client_body; pcre:"/__proto__|constructor\.prototype|prototype\./i"; classtype:attempted-dos; reference:cve,2022-36060; sid:202236060; rev:1;)

Elastic Detection

// Detect event content that includes proto pollution indicators
any where event.dataset == "matrix" and (
  (event.action == "message" or event.action == "state_event") and
  (wildcard(message_body, "*__proto__*") or
   wildcard(message_body, "*constructor.prototype*") or
   wildcard(event_dict.*, "*__proto__*"))
)

Splunk SPL Query

index=matrix sourcetype=matrix:event
| search "*__proto__*" OR "*constructor*" OR "*prototype*"
| where event_type="m.room.message" OR event_type="m.room.state"
| stats count by sender, room_id, source, _time
| eval cve="CVE-2022-36060"
| table _time, sender, room_id, source, count, cve
| sort - _time

Wazuh OSSEC Rule

<group name="matrix,">
  <rule id="692713" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_sender">\.+</field>
    <match>__proto__</match>
    <description>Matrix event containing prototype pollution indicator (CVE-2022-36060)</description>
    <group>cve-2022-36060,attack.t1499,</group>
  </rule>
  <rule id="692714" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_sender">\.+</field>
    <match>constructor\.prototype</match>
    <description>Matrix event with constructor.prototype pollution attempt (CVE-2022-36060)</description>
    <group>cve-2022-36060,attack.t1499,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. However, the NVD description explicitly states the issue is fixed in matrix-react-sdk 3.53.0. This instructs us to upgrade the SDK to version 3.53.0 or later.

1) Immediate Mitigations:

• Upgrade to matrix-react-sdk 3.53.0 — this is the only known remediating action; no workarounds are documented.
• If immediate upgrade is not possible, restrict room membership in high-value rooms — reduce the pool of actors who can send events.
• Enable read-only mode in critical rooms if your deployment supports it, blocking non-admin users from sending events.
• Monitor client-side error logs for unexpected React render exceptions in event/room tiles, which may indicate active exploitation.

2) Patch/Upgrade Steps:

• For deployments using Element Web: upgrade the client package to >= 3.53.0.
• For custom applications embedding the SDK: update the npm package matrix-react-sdk to version 3.53.0 or latest stable.
• After upgrade, verify all federated homeservers deliver the new client version to users (element self-hosted deployments serve the web bundle; ensure cache headers force refresh).
• Test critical rooms after upgrade to validate rendering integrity.

3) Long-Term Hardening:

• Input validation: Implement a homeserver-side policy (Synapse module hook or custom middleware) that rejects event fields whose keys match __proto__, constructor, or prototype patterns at the federation ingress. This not only blocks this CVE but future prototype pollution vectors.
• Dependency hygiene: Add automated scanning (e.g., npm audit, Snyk, or OSV-scanner) to CI/CD pipelines to flag matrix-react-sdk and its transitive dependencies for prototype pollution advisories.
• Client-side hardening: If the organization controls the client code, apply defensive deep-merge utilities that strip dangerous keys (__proto__, prototype, constructor) from untrusted event objects before rendering.
• Monitoring: Deploy real-time detection rules (Sigma/YARA/Suricata) at the homeserver and SIEM layer to identify events with pollution-indicator keys. Subscribe to the GitHub advisory for matrix-react-sdk to receive future CVE alerts promptly.
• Patch confidence tracking: Re-run patch validation 24–48 hours after the CVE was published (data shows 0/4 tracked sources with patch evidence). Re-check vendor advisories for an official patch confirmation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-36060 — official CVE record with description, CVSS score, and version information.
2. GitHub Advisory for matrix-react-sdk (CNA source): https://github.com/matrix-org/matrix-react-sdk/security/advisories — contains the advisory and details of the fix in 3.53.0.
3. Matrix React SDK repository (release notes for v3.53.0): https://github.com/matrix-org/matrix-react-sdk/releases — confirming the version where the patch was applied.
4. CWE-1321 Improperly Controlled Modification of Object Prototype Attributes: https://cwe.mitre.org/data/definitions/1321.html — reference for the vulnerability class.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — confirms CVE-2022-36060 is NOT listed; no known in-the-wild exploitation as of the latest catalog update.

Threat actor activity: No known threat campaigns or exploit-in-the-wild evidence. EPSS percentile of 56.5% indicates moderate-to-low risk of exploitation in the near term, but the ease of triggering (network venue, no privileges) elevates the practical risk for Matrix users in untrusted rooms.