Cross-site scripting in Synapse - CVE-2020-26891

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via "AuthRestServlet" when supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/m.login.recaptcha or /_matrix/client/r0/auth/m.login.terms Synapse 974923. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website .

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

External links

• https://github.com/matrix-org/synapse/pull/8444
• https://github.com/matrix-org/synapse/releases
• https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisory