CVE-2023-32683: URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
Impact A discovered oEmbed or image URL can bypass the urlpreviewurlblacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the urlpreviewiprangeblacklist setting (by default this only allows public IPs) and by the limited information returned to the client:
For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. For discovered image URLs, any non-image response is discarded.
Systems which have URL preview disabled (via the urlpreviewenabled setting) or have not configured a urlpreviewurlblacklist are not affected.
Because of the uncommon configuration required, the limited information a malicious user, and the amount of guesses/time the attack would need; the severity is rated as low.
Patches
The issue is fixed by #15601.
Workarounds
The default configuration of the urlpreviewiprangeblacklist should protect against requests being made to internal infrastructure, URL previews of public URLs is expected.
Alternately URL previews could be disabled using the urlpreviewenabled setting.
Other sources
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the urlpreviewurlblacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the urlpreviewiprangeblacklist setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the urlpreviewenabled setting) or have not configured a urlpreviewurlblacklist are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-32683?
CVE-2023-32683 is a vulnerability in Synapse, a Matrix protocol homeserver, that allows bypassing network policies and potentially enables server-side request forgery.
What is the impact of CVE-2023-32683?
The impact of CVE-2023-32683 is limited to IP addresses allowed by the 'url_preview_url_blacklist' setting in Synapse.
How can CVE-2023-32683 be exploited?
CVE-2023-32683 can be exploited by using a discovered oEmbed or image URL to bypass the 'url_preview_url_blacklist' setting in Synapse, potentially leading to server-side request forgery or bypassing network policies.
How can I fix CVE-2023-32683?
To fix CVE-2023-32683, update your Synapse installation to version 1.85.0 or above.
Where can I find more information about CVE-2023-32683?
You can find more information about CVE-2023-32683 in the GitHub pull request and security advisory, as well as the Fedora Project mailing list.