CVE-2020-26257
Denial of service attack via incorrect parameters to federation APIs
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
Matrix es un ecosistema para VoIP y mensajería instantánea federada abierta. Synapse es una implementación "homeserver" de referencia de Matrix. Un servidor doméstico malicioso o mal implementado puede inyectar eventos malformados en una sala especificando un ID de sala diferente en la ruta de una petición "/send_join", "/send_leave", "/invite" o "/exchange_third_party_invite". Esto puede conllevar a una denegación de servicio en la que los eventos futuros no serán enviados correctamente a otros servidores por medio de la federación. Esto afecta a cualquier servidor que acepte peticiones de federación de servidores que no sean confiables. La implementación de referencia de Matrix Synapse anterior a la versión 1.23.1 es vulnerable a este ataque de inyección. El problema se corrigió en la versión 1.23.1. Como solución alternativa, los administradores de servidores domésticos podrían limitar el acceso a la API de federación a servidores de confianza (por ejemplo, por medio de "federation_domain_whitelist")
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-10-01 CVE Reserved
- 2020-12-09 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09 | Release Notes | |
| https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b | 2023-11-07 | |
| https://github.com/matrix-org/synapse/pull/8776 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Matrix Search vendor "Matrix" | Synapse Search vendor "Matrix" for product "Synapse" | < 1.23.1 Search vendor "Matrix" for product "Synapse" and version " < 1.23.1" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||