XSS in Matrix Synapse
CVE-2020-26257
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.024 (83.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.024 · newest: 0.024 · change: +0.000
Affected products
- Matrix Synapse
- Matrix-Org Synapse — versions < 1.23.1
- Fedoraproject Fedora — versions 32, 33
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm (Third Party Advisory)
- github.com/matrix-org/synapse/pull/8776 (Patch, Third Party Advisory)
- github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b (Patch, Third Party Advisory)
- github.com/matrix-org/synapse/blob/develop/CHANGES.md (Third Party Advisory, Release Notes)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2020-26257?
- CVE-2020-26257 is a medium-severity vulnerability in Matrix Synapse, classified under Cross-site Scripting. CVSS score: 6.5/10. Published 2020-12-09.
- How severe is CVE-2020-26257?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2020-26257 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.