GitHub Advisoryadvisory · PyPI

GHSA-3x8c-fmpc-5rmq Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint

MEDIUM Published 2020-10-16 Modified 2024-09-24 Official page ↗
Aliases
CVE-2020-26891
Ecosystem
PyPI
Packages
matrix-synapse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-10-16

Affected packages

• PyPI matrix-synapse: < 1.21.0 → fixed in 1.21.0

Description

Impact The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. Patches This is fixed by #8444, which is included in Synapse v1.21.0. Workarounds If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy: • `/_matrix/client/r0/auth/.*/fallback/web` • `/_matrix/client/unstable/auth/.*/fallback/web`

Related

Alias · CVE (1)

  • CVE-2020-26891 AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References