CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31152 – Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
https://notcve.org/view.php?id=CVE-2022-31152
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. • https://github.com/matrix-org/synapse/pull/13087 https://github.com/matrix-org/synapse/pull/13088 https://github.com/matrix-org/synapse/releases/tag/v1.62.0 https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765 • CWE-703: Improper Check or Handling of Exceptional Conditions CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31052 – URL previews can crash Synapse media repositories or Synapse monoliths
https://notcve.org/view.php?id=CVE-2022-31052
Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. • https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333 https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EARKKJZ2W7WUITFDT4EG4NVATFYJQHF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGSDQ4YAITCUACAB7SXQZDJIU3IQ4CJD https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url • CWE-674: Uncontrolled Recursion •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 3CVE-2021-44226 – Razer Synapse 3.6.x DLL Hijacking
https://notcve.org/view.php?id=CVE-2021-44226
Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there. Razer Synapse versiones anteriores a 3.7.0228.022817, permite una escalada de privilegios porque es basado en %PROGRAMDATA%\Razer\Synapse3\Service\bin incluso si %PROGRAMDATA%\Razer ha sido creado por cualquier usuario no privilegiado antes de la instalación de Synapse. El usuario no privilegiado puede haber colocado allí DLLs troyanos Razer Synapse versions prior to 3.7.0228.022817 suffer from a dll hijacking vulnerability. • http://packetstormsecurity.com/files/166485/Razer-Synapse-3.6.x-DLL-Hijacking.html http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html http://seclists.org/fulldisclosure/2022/Mar/51 http://seclists.org/fulldisclosure/2023/Jan/26 http://seclists.org/fulldisclosure/2023/Sep/6 https://www.razer.com/community https://www.syss.de/fileadmin/dokumente/Publikationen& • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-41281 – Path traversal in Matrix Synapse
https://notcve.org/view.php?id=CVE-2021-41281
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. • https://github.com/matrix-org/synapse/commit/91f2bd090 https://github.com/matrix-org/synapse/releases/tag/v1.47.1 https://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EU7QRE55U4IUEDLKT5IYPWL3UXMELFAS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N3WY56LCEZ4ZECLWV5KMAXF2PSMUB4F2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39164 – Improper authorisation of /members discloses room membership to non-members
https://notcve.org/view.php?id=CVE-2021-39164
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. • https://github.com/matrix-org/synapse/commit/cb35df940a https://github.com/matrix-org/synapse/releases/tag/v1.41.1 https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •