CVE-2023-42453: Improper validation of receipts allows forged read receipts in matrix synapse
Impact Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room.
Patches https://github.com/matrix-org/synapse/pull/16327
Workarounds There is no workaround.
Other sources
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the impact of CVE-2023-42453?
Users were able to forge read receipts for any event (if they knew the room ID and event ID), causing clients to show the event as read by the user even if they are not in the room.
How can users forge read receipts with CVE-2023-42453?
By knowing the room ID and event ID, users could mark any event as read.
What software is affected by CVE-2023-42453?
The 'matrix-synapse' package with a version between 0.34.0 and 1.93.0, installed via 'pip'.
How can I fix CVE-2023-42453?
Update the 'matrix-synapse' package to version 1.93.0 or higher using 'pip' package manager.
Where can I find more information about CVE-2023-42453?
You can find more information about CVE-2023-42453 on the GitHub security advisory page.