Incorrect Authorization Affecting matrix-synapse package, versions [,1.85.0rc1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MATRIXSYNAPSE-5668924
- published 7 Jun 2023
- disclosed 6 Jun 2023
- credit Unknown
Introduced: 6 Jun 2023
CVE-2023-32682 Open this link in a new tabHow to fix?
Upgrade matrix-synapse to version 1.85.0rc1 or higher.
Overview
matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.
Affected versions of this package are vulnerable to Incorrect Authorization in that it does not check for deactivated status of users during login, under certain conditions. Specifically, JSON Web Tokens must be enabled via the jwt_config.enabled setting, the local password database must be enabled via the password_config.enabled and password_config.localdb_enabled settings, and a user's password must be updated via an admin API after a user is deactivated.
NOTE: Installations configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.
If not using JSON Web Tokens, the list of deactivated users with a password set can be queried from PostgreSQL:
SELECT name FROM users WHERE password_hash IS NOT NULL AND deactivated = 1;