pysec - pysec-2021-134

pysec-2021-134

Vulnerability from pysec

Published

2021-03-26 20:15

Modified

2021-08-27 03:22

Details

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse",
        "purl": "pkg:pypi/matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e54746bdf7d5c831eabe4dcea76a7626f1de73df"
            }
          ],
          "repo": "https://github.com/matrix-org/synapse",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.33.5",
        "0.33.5.1",
        "0.33.6",
        "0.33.6rc1",
        "0.33.7",
        "0.33.7rc1",
        "0.33.7rc2",
        "0.33.8",
        "0.33.8rc2",
        "0.33.9",
        "0.34.0",
        "0.34.0.1",
        "0.34.0rc1",
        "0.34.0rc2",
        "0.34.1.1",
        "0.99.0",
        "0.99.0rc1",
        "0.99.0rc2",
        "0.99.0rc3",
        "0.99.0rc4",
        "0.99.1",
        "0.99.1.1",
        "0.99.1rc1",
        "0.99.1rc2",
        "0.99.2",
        "0.99.2rc1",
        "0.99.3",
        "0.99.3.1",
        "0.99.3.2",
        "0.99.3rc1",
        "0.99.4",
        "0.99.4rc1",
        "0.99.5",
        "0.99.5.1",
        "0.99.5.2",
        "0.99.5rc1",
        "1.0.0",
        "1.0.0rc1",
        "1.0.0rc2",
        "1.0.0rc3",
        "1.1.0",
        "1.1.0rc1",
        "1.1.0rc2",
        "1.10.0",
        "1.10.0rc1",
        "1.10.0rc2",
        "1.10.0rc3",
        "1.10.0rc5",
        "1.10.1",
        "1.11.0",
        "1.11.0rc1",
        "1.11.1",
        "1.12.0",
        "1.12.0rc1",
        "1.12.1",
        "1.12.1rc1",
        "1.12.2",
        "1.12.3",
        "1.12.4",
        "1.12.4rc1",
        "1.13.0",
        "1.13.0rc1",
        "1.13.0rc2",
        "1.13.0rc3",
        "1.14.0",
        "1.14.0rc1",
        "1.14.0rc2",
        "1.15.0",
        "1.15.0rc1",
        "1.15.1",
        "1.15.2",
        "1.16.0",
        "1.16.0rc1",
        "1.16.0rc2",
        "1.16.1",
        "1.17.0",
        "1.17.0rc1",
        "1.18.0",
        "1.18.0rc1",
        "1.18.0rc2",
        "1.19.0",
        "1.19.0rc1",
        "1.19.1",
        "1.19.1rc1",
        "1.19.2",
        "1.19.3",
        "1.2.0",
        "1.2.0rc1",
        "1.2.0rc2",
        "1.2.1",
        "1.20.0",
        "1.20.0rc1",
        "1.20.0rc2",
        "1.20.0rc3",
        "1.20.0rc4",
        "1.20.0rc5",
        "1.20.1",
        "1.21.0",
        "1.21.0rc1",
        "1.21.0rc2",
        "1.21.0rc3",
        "1.21.1",
        "1.21.2",
        "1.22.0",
        "1.22.0rc1",
        "1.22.0rc2",
        "1.22.1",
        "1.23.0",
        "1.23.0rc1",
        "1.23.1",
        "1.24.0",
        "1.24.0rc1",
        "1.24.0rc2",
        "1.25.0",
        "1.25.0rc1",
        "1.26.0",
        "1.26.0rc1",
        "1.26.0rc2",
        "1.27.0rc1",
        "1.27.0rc2",
        "1.3.0",
        "1.3.0rc1",
        "1.3.1",
        "1.4.0",
        "1.4.0rc1",
        "1.4.0rc2",
        "1.4.1",
        "1.4.1rc1",
        "1.5.0",
        "1.5.0rc1",
        "1.5.0rc2",
        "1.5.1",
        "1.6.0",
        "1.6.0rc1",
        "1.6.0rc2",
        "1.6.1",
        "1.7.0",
        "1.7.0rc1",
        "1.7.0rc2",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.8.0",
        "1.8.0rc1",
        "1.9.0",
        "1.9.0.dev1",
        "1.9.0.dev2",
        "1.9.0rc1",
        "1.9.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21333",
    "GHSA-c5f8-35qr-q4fm"
  ],
  "details": "Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.",
  "id": "PYSEC-2021-134",
  "modified": "2021-08-27T03:22:06.710356Z",
  "published": "2021-03-26T20:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/pull/9200"
    },
    {
      "type": "FIX",
      "url": "https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/releases/tag/v1.27.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm"
    }
  ]
}

ghsa-c5f8-35qr-q4fm

Vulnerability from github

Published

2021-03-26 19:53

Modified

2024-09-30 20:35

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
4.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Summary

HTML injection in email and account expiry notifications

Details

Impact

The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.

The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.

Patches

This issue is fixed in #9200.

Workarounds

For the missed messages notifications:

The notif.html, notif_mail.html, and room.html templates can be overridden with custom templates that manually escapes the variables using JInja2's escape filter. See the email.template_dir setting.

For the account expiry notifications:

Account expiry can be disabled via the account_validity.enabled setting.
The notice_expiry.html template can be overridden with a custom template that manually escapes the variables using JInja2's escape filter. See the email.template_dir setting.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21333"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-26T19:52:46Z",
    "nvd_published_at": "2021-03-26T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.\n\nThe account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.\n\n### Patches\nThis issue is fixed in #9200.\n\n### Workarounds\nFor the missed messages notifications:\n\nThe `notif.html`, `notif_mail.html`, and `room.html` templates can be overridden with custom templates that manually escapes the variables using [JInja2\u0027s `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.\n\nFor the account expiry notifications:\n\n1. Account expiry can be disabled via the `account_validity.enabled` setting.\n\n2. The `notice_expiry.html` template can be overridden with a custom template that manually escapes the variables using [JInja2\u0027s `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.",
  "id": "GHSA-c5f8-35qr-q4fm",
  "modified": "2024-09-30T20:35:33Z",
  "published": "2021-03-26T19:53:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21333"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/pull/9200"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/synapse"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/releases/tag/v1.27.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-134.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "HTML injection in email and account expiry notifications"
}

cve-2021-21333

Vulnerability from cvelistv5

Published

2021-03-26 20:00

Modified

2024-08-03 18:09

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

HTML injection in email and account expiry notifications

References

▼	URL	Tags
	https://github.com/matrix-org/synapse/releases/tag/v1.27.0	x_refsource_MISC
	https://github.com/matrix-org/synapse/pull/9200	x_refsource_MISC
	https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df	x_refsource_MISC
	https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/	vendor-advisory, x_refsource_FEDORA

Impacted products

Vendor

Product

Version

▼

matrix-org

synapse

Version: < 1.27.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.578Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/releases/tag/v1.27.0"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/pull/9200"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm"
          },
          {
            "name": "FEDORA-2021-a627cfd31e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "synapse",
          "vendor": "matrix-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-02T02:06:36",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/matrix-org/synapse/releases/tag/v1.27.0"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/matrix-org/synapse/pull/9200"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm"
        },
        {
          "name": "FEDORA-2021-a627cfd31e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/"
        }
      ],
      "source": {
        "advisory": "GHSA-c5f8-35qr-q4fm",
        "discovery": "UNKNOWN"
      },
      "title": "HTML injection in email and account expiry notifications",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21333",
          "STATE": "PUBLIC",
          "TITLE": "HTML injection in email and account expiry notifications"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "synapse",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.27.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "matrix-org"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/matrix-org/synapse/releases/tag/v1.27.0",
              "refsource": "MISC",
              "url": "https://github.com/matrix-org/synapse/releases/tag/v1.27.0"
            },
            {
              "name": "https://github.com/matrix-org/synapse/pull/9200",
              "refsource": "MISC",
              "url": "https://github.com/matrix-org/synapse/pull/9200"
            },
            {
              "name": "https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df",
              "refsource": "MISC",
              "url": "https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df"
            },
            {
              "name": "https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm",
              "refsource": "CONFIRM",
              "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-c5f8-35qr-q4fm"
            },
            {
              "name": "FEDORA-2021-a627cfd31e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-c5f8-35qr-q4fm",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21333",
    "datePublished": "2021-03-26T20:00:19",
    "dateReserved": "2020-12-22T00:00:00",
    "dateUpdated": "2024-08-03T18:09:15.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2021-134

Vulnerability from pysec

ghsa-c5f8-35qr-q4fm

Vulnerability from github

Impact

Patches

Workarounds

cve-2021-21333

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature