CVE-2020-26891 Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint

What is CVE-2020-26891?

CVE-2020-26891 is a medium-severity cross-site scripting vulnerability in n/a, published on 19 Oct 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.

Weakness: CWE-79

Which versions are affected by CVE-2020-26891?

3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.

Products include Matrix Synapse.

How do I fix CVE-2020-26891?

Upgrade matrix-synapse to 1.21.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-26891 being exploited?

There is no known exploitation of CVE-2020-26891 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse Critical 9.8
• CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync` High 8.7
• CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion High 8.2
• CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders High 8.2
• CVE-2024-37302 Synapse denial of service through media disk space consumption High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3x8c-fmpc-5rmq, PYSEC-2020-238, UBUNTU-CVE-2020-26891.