CVE-2023-32682 Improper checks for deactivated users during login in synapse
Deactivated users may bypass authentication and log in under specific uncommon configurations, allowing unauthorized access to their accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32682?
CVE-2023-32682 is a medium-severity authentication bypass vulnerability in matrix-org synapse, published on 6 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.
Weakness: CWE-287
Which versions are affected by CVE-2023-32682?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.85.0 |
matrix-synapse PyPI | All versions | 1.85.0 |
matrix-synapse PyPI | All versions | 1.85.0 |
Products include Matrix Synapse.
How do I fix CVE-2023-32682?
Upgrade matrix-synapse to 1.85.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-32682 being exploited?
There is no known exploitation of CVE-2023-32682 in the wild and no public exploit code.
Other vulnerabilities in matrix-org synapse
- CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
- CVE-2024-37302 Synapse denial of service through media disk space consumption
Sources
Also known as GHSA-26c5-ppr8-f33p, PYSEC-2023-84, UBUNTU-CVE-2023-32682.