PT-2021-14428 · Synapse+1 · Synapse+1

Clokep · Published 2021-02-24 · Updated 2022-10-21 · CVE-2021-21333

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.27.0

Description The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.

Recommendations For versions prior to 1.27.0, update to version 1.27.0 to resolve the issue. As a temporary workaround, consider overriding the notif.html, notif mail.html, and room.html templates with custom templates that manually escape the variables using Jinja2's escape filter for the missed messages notifications. For the account expiry notifications, consider disabling the account expiry feature via the account validity.enabled setting or overriding the notice expiry.html template with a custom template that manually escapes the variables using Jinja2's escape filter.

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

ALT-PU-2021-1385

CVE-2021-21333

GHSA-C5F8-35QR-Q4FM

PYSEC-2021-134

Affected Products

Alt Linux

Synapse

References · 18

• https://github.com/matrix-org/synapse/pull/9200 · Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm · Patch
• https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df · Patch
• https://osv.dev/vulnerability/GHSA-c5f8-35qr-q4fm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-134 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21333 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21333 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21333 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21333 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21333 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21333 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY · Vendor Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.27.0 · Note