CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32683 – URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
https://notcve.org/view.php?id=CVE-2023-32683
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. • https://github.com/matrix-org/synapse/pull/15601 https://github.com/matrix-org/synapse/security/advisories/GHSA-98px-6486-j7qc https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2 • CWE-863: Incorrect Authorization CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32682 – Improper checks for deactivated users during login in synapse
https://notcve.org/view.php?id=CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. • https://github.com/matrix-org/synapse/pull/15624 https://github.com/matrix-org/synapse/pull/15634 https://github.com/matrix-org/synapse/security/advisories/GHSA-26c5-ppr8-f33p https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2 https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account https://matrix-org.github.io/synapse/latest/jwt.html https://matrix-org.github.io/synapse/latest/usage& • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39335 – Synapse does not apply enough checks to servers requesting auth events of events in a room
https://notcve.org/view.php?id=CVE-2022-39335
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. • https://github.com/matrix-org/synapse/issues/13288 https://github.com/matrix-org/synapse/pull/13823 https://github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2MBNMZAFY4RCZL2VGBGAPKGB4JUPZVS • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-32323 – Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
https://notcve.org/view.php?id=CVE-2023-32323
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. • https://github.com/matrix-org/synapse/issues/14492 https://github.com/matrix-org/synapse/pull/14642 https://github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvr https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 2CVE-2022-47632 – Razer Synapse 3.7.0731.072516 Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2022-47632
Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. • http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html http://seclists.org/fulldisclosure/2023/Sep/6 https://syss.de https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-047.txt • CWE-427: Uncontrolled Search Path Element •