Multiple vulnerabilities in Matrix Synapse

Published: 2023-10-04

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-41335 CVE-2023-42453
CWE-ID	CWE-312 CWE-284
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Synapse Server applications / Conferencing, Collaboration and VoIP solutions
Vendor	Matrix.org

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cleartext storage of sensitive information

EUVDB-ID: #VU81454

Risk: Low

CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-41335

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a user to gain access to sensitive information.

The vulnerability exists due to the way the application handles password change. When users update their passwords, the new credentials may be briefly held in the server database in clear text. A user with access to the database can obtain the password in clear text.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Synapse: 1.66.0 - 1.92.3

External links

http://github.com/matrix-org/synapse/pull/16272
http://github.com/matrix-org/synapse/security/advisories/GHSA-4f74-84v3-j9q5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU81455

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42453

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can forge read receipts for any event and mark the events as read for other application users.