CVE-2020-26891: XSS
First published: Fri Oct 16 2020(Updated: )
### Impact The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. ### Patches This is fixed by #8444, which is included in Synapse v1.21.0. ### Workarounds If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy: * `/_matrix/client/r0/auth/.*/fallback/web` * `/_matrix/client/unstable/auth/.*/fallback/web`
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Matrix Synapse | <1.21.0 | |
| pip/matrix-synapse | <1.21.0 | 1.21.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/matrix-org/synapse/pull/8444
- https://github.com/matrix-org/synapse/releases/tag/v1.21.2
- https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq
- https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-26891
- https://github.com/matrix-org/synapse/releases
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-238.yaml
- https://github.com/advisories/GHSA-3x8c-fmpc-5rmq (Advisory)
Frequently Asked Questions
What is CVE-2020-26891?
CVE-2020-26891 is a vulnerability in Matrix Synapse before version 1.21.0 that allows for XSS attacks due to unsafe interpolation of the session GET parameter.
How can an attacker exploit CVE-2020-26891?
An attacker can exploit CVE-2020-26891 by supplying a malicious URL to the /_matrix/client/r0/auth/* endpoint, which can execute an XSS attack on the domain Synapse is hosted on.
What is the severity of CVE-2020-26891?
CVE-2020-26891 has a severity rating of 6.1 (Medium).
How can I fix CVE-2020-26891?
To fix CVE-2020-26891, upgrade Matrix Synapse to version 1.21.0 or later.
Where can I find more information about CVE-2020-26891?
More information about CVE-2020-26891 can be found in the references provided: [GitHub Pull Request](https://github.com/matrix-org/synapse/pull/8444), [GitHub Release](https://github.com/matrix-org/synapse/releases/tag/v1.21.2), [GitHub Security Advisory](https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq)
- collector/nvd-index
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3x8c-fmpc-5rmq
- alias/CVE-2020-26891
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/matrix
- canonical/matrix synapse
- package-manager/pip