CVE-2023-32682: Matrix Synapse improper deactivated user checks during login

CVE-2023-32682 · Severity: low · CVSS 3.1 · Published 2023-06-06

Matrix Synapse is an open-source server implementation for the Matrix protocol, used to host real-time communication networks. A flaw in deactivated user validation allows deactivated accounts to regain access under specific configurations (JWT-based login or when admin-modified passwords exist on deactivated accounts), potentially enabling unauthorized access to messaging infrastructure.

Technologies: matrix-synapse (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-32682 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-32682 being exploited in the wild.
How severe is CVE-2023-32682?
Low severity, with a CVSS score of 3.1, published 6 June 2023.
Which products and versions are affected?
matrix-synapse (PyPI) ECOSYSTEM:introduced=0,fixed=1.85.0.
Is there a fix for CVE-2023-32682?
Yes. matrix-synapse (PyPI): upgrade to 1.85.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-32682 attacked?
It is attacked over the network.
Am I affected by CVE-2023-32682?
Check whether you run matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-synapse (PyPI): upgrade to 1.85.0 or later
    pip install "matrix-synapse>=1.85.0"

Technical details

The vulnerability is an authentication bypass (CWE-287) affecting Synapse's login validation logic for deactivated user accounts. The flaw manifests under two configurations: (1) when JSON Web Token (JWT) login is enabled via jwt_config.enabled, or (2) when local password authentication is enabled and a deactivated user's password was reset via the admin API after deactivation. The attack requires no special privileges and is exploitable via the network at login time. A threat actor can authenticate as a deactivated user, gaining full access to that account. Installations using only SSO (CAS, SAML, OIDC) or external password providers (LDAP) are unaffected. Patches are available in version 1.85.0 and later.

Affected products

  • Matrix.org Synapse before 1.85.0

Identifiers

  • CVE-2023-32682
  • GHSA-26c5-ppr8-f33p
  • PYSEC-2023-84

Timeline

  • 2023-06-06: disclosed
  • 2023-06-06: patched: Version 1.85.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.