PT-2020-16533 · Matrix+1 · Matrix Synapse+1

Dkasak · Published 2020-10-13 · Updated 2024-06-15 · CVE-2020-26891

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 1.21.0

Description The issue is due to unsafe interpolation of the session GET parameter in the AuthRestServlet, allowing a remote attacker to execute a cross-site scripting (XSS) attack. This can be done by supplying a victim user with a malicious URL to the "/ matrix/client/r0/auth//fallback/web" or "/ matrix/client/unstable/auth//fallback/web" Synapse endpoints. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

Recommendations For Matrix Synapse versions prior to 1.21.0, update to version 1.21.0 or later to fix the issue. As a temporary workaround, consider blocking the affected endpoints at a reverse proxy:

• "/ matrix/client/r0/auth/.*/fallback/web"
• "/ matrix/client/unstable/auth/.*/fallback/web" This workaround is applicable if the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3036

ALT-PU-2020-3063

CVE-2020-26891

GHSA-3X8C-FMPC-5RMQ

OPENSUSE-SU-2024:11041-1

PYSEC-2020-238

Affected Products

Alt Linux

Matrix Synapse

References · 29

• https://github.com/matrix-org/synapse/pull/8444 · Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26891 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26891 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26891 · Security Note
• https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisory · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11041-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3x8c-fmpc-5rmq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-238 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26891 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26891 · Vendor Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.21.2 · Note
• https://github.com/matrix-org/synapse/releases · Note