PT-2021-14427 · Synapse+1 · Synapse+1

Clokep · Published 2021-02-24 · Updated 2021-11-23 · CVE-2021-21332

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.27.0

Description The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

Recommendations For Synapse versions prior to 1.27.0, update to version 1.27.0 to fix the issue. As a temporary workaround, consider disabling password resets by delegating email to a third-party service via the account threepid delegates.email setting or disabling email by not configuring the email setting. If the homeserver is not configured to use passwords via the password config.enabled setting, then the affected endpoint can be blocked at a reverse proxy: / synapse/client/password reset/email/submit token. The password reset confirmation.html template can be overridden with a custom template that manually escapes the variables using Jinja2's escape filter, see the email.template dir setting.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-1385

CVE-2021-21332

GHSA-246W-56M2-5899

PYSEC-2021-133

Affected Products

Alt Linux

Synapse

References · 19

• https://github.com/matrix-org/synapse/pull/9200 · Patch
• https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df · Patch
• https://osv.dev/vulnerability/PYSEC-2021-133 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-246w-56m2-5899 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21332 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21332 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21332 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21332 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21332 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21332 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21332 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-246w-56m2-5899 · Note
• https://github.com/matrix-org/synapse/releases/tag/v1.27.0 · Note