Vulnerability · Published Jun 6, 2023 · Assigned by GitHub_M
CVE-2023-32683URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
Low 3.5
In plain English
A low-severity incorrect authorization in synapse from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | synapse | 1.85.1-r0 | ALPINE-CVE-2023-32683 |
| Alpine:v3.21 | synapse | 1.85.1-r0 | ALPINE-CVE-2023-32683 |
| Alpine:v3.22 | synapse | 1.85.1-r0 | ALPINE-CVE-2023-32683 |
| Alpine:v3.23 | synapse | 1.85.1-r0 | ALPINE-CVE-2023-32683 |
| Alpine:v3.24 | synapse | 1.85.1-r0 | ALPINE-CVE-2023-32683 |
| Debian:14 | matrix-synapse | 1.90.0-1 | DEBIAN-CVE-2023-32683 |
| PyPI | matrix-synapse | 1.85.0 | GHSA-98px-6486-j7qc |
| PyPI | matrix-synapse | 1.85.0 | PYSEC-2023-85 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | synapse | < 1.85.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N