PT-2023-23958 · Synapse+3 · Synapse+3

Rikjohnston · Published 2023-06-06 · Updated 2025-04-22 · CVE-2023-32683

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.85.0

Description A discovered oEmbed or image URL can bypass the url preview url blacklist setting, potentially allowing server-side request forgery or bypassing network policies. The impact is limited to IP addresses allowed by the url preview ip range blacklist setting and by the limited information returned to the client. For discovered oEmbed URLs, any non-JSON response or a JSON response that includes non-oEmbed information is discarded. For discovered image URLs, any non-image response is discarded. Systems with URL preview disabled or without a configured url preview url blacklist are not affected.

Recommendations For versions prior to 1.85.0, upgrade to version 1.85.0 to resolve the issue. As a temporary workaround, consider disabling URL previews by setting url preview enabled to False until a patch is available. Restrict access to the url preview ip range blacklist setting to minimize the risk of exploitation. Avoid using the url preview url blacklist setting in configurations where it may be bypassed until the issue is resolved.

Exploit

Fix

SSRF

Incorrect Authorization

Weakness Enumeration

CWE-918

CWE-863

Related Identifiers

ALT-PU-2023-4748

CVE-2023-32683

GHSA-98PX-6486-J7QC

OPENSUSE-SU-2024:13039-1

PYSEC-2023-85

USN-7444-1

Affected Products

Alt Linux

Linuxmint

Synapse

Ubuntu

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32683.json · Exploit
• https://github.com/matrix-org/synapse/pull/15601 · Patch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-98px-6486-j7qc · Vendor Advisory
• https://osv.dev/vulnerability/USN-7444-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32683 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32683 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-32683 · Security Note
• https://ubuntu.com/security/notices/USN-7444-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53863 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-32683 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32683 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-98px-6486-j7qc · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39335 · Vendor Advisory