CVE-2021-21333 HTML injection in email and account expiry notifications
Attackers can inject HTML into Synapse notification emails, potentially forging content or bypassing security controls in missed message notifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21333?
CVE-2021-21333 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 26 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
Which versions are affected by CVE-2021-21333?
3 open source packages ship an affected version, including matrix-synapse. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.27.0 |
matrix-synapse PyPI | All versions | 1.27.0 |
matrix-synapse PyPI | All versions | 1.27.0 |
Products include Fedoraproject Fedora, Matrix Synapse.
How do I fix CVE-2021-21333?
Upgrade matrix-synapse to 1.27.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-21333 being exploited?
There is no known exploitation of CVE-2021-21333 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-c5f8-35qr-q4fm, PYSEC-2021-134, UBUNTU-CVE-2021-21333.