CVE-2020-26891
published 2020-10-19CVE-2020-26891: AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.93%
77.8th percentile
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | matrix-synapse | < matrix-synapse 1.21.1-1 (forky) | matrix-synapse 1.21.1-1 (forky) |
| matrix | synapse | < 1.21.0 | 1.21.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2020-26891: matrix-synapse - AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsa...
vendor_debian·2020·CVSS 6.1
CVE-2020-26891 [MEDIUM] CVE-2020-26891: matrix-synapse - AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsa...
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.
Scope: local
forky: resolved (fixed in 1.21.1-1)
sid: resolved (fixed in 1.21.1-1)
OSV
CVE-2020-26891: AuthRestServlet in Matrix Synapse before 1
osv·2020-10-19·CVSS 6.1
CVE-2020-26891 [MEDIUM] CVE-2020-26891: AuthRestServlet in Matrix Synapse before 1
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.
GHSA
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
ghsa·2020-10-16
CVE-2020-26891 [MEDIUM] CWE-79 Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
### Impact
The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.
### Patches
This is fixed by #8444, which is included in Synapse v1.21.0.
### Workarounds
If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy:
* `/_matrix/client/r0/auth/.*/fallback/web`
* `/_matrix/client/unstable/auth/.*/fallback/web`
OSV
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
osv·2020-10-16
CVE-2020-26891 [MEDIUM] Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
### Impact
The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.
### Patches
This is fixed by #8444, which is included in Synapse v1.21.0.
### Workarounds
If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy:
* `/_matrix/client/r0/auth/.*/fallback/web`
* `/_matrix/client/unstable/auth/.*/fallback/web`
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/matrix-org/synapse/pull/8444https://github.com/matrix-org/synapse/releases/tag/v1.21.2https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmqhttps://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisoryhttps://github.com/matrix-org/synapse/pull/8444https://github.com/matrix-org/synapse/releases/tag/v1.21.2https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmqhttps://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisory
2020-10-19
Published