HTML Injection Vulnerability in Matrix Synapse Notification Emails
Summary
CVE-2021-21333: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Affects matrix-synapse across 2 version ranges.
< 1.27.0-1
< e54746bdf7d5c831eabe4dcea76a7626f1de73df
Fixed in 1.27.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is a reference homeserver for the Matrix protocol, which facilitates open federated Instant Messaging and VoIP. The software is implemented in Python and is widely used for real-time communication. Synapse allows users to send and receive messages, manage accounts, and handle notifications. However, prior to version 1.27.0, it was found to be vulnerable to HTML injection in its notification emails, which could potentially compromise user data and trust.
Vulnerability Detail
The vulnerability arises from improper handling of HTML content in notification emails sent by Synapse for missed messages and expiring accounts. Attackers could exploit this flaw to inject malicious HTML content into the emails, leading to potential phishing attacks or the display of forged information. Although the account expiry feature is not enabled by default, the risk associated with missed message notifications remains significant, as it could mislead users into taking harmful actions.
How To Fix
Minimum fixed version
1.27.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade matrix-synapseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable notification emails for missed messages until the upgrade is performed. This can be done by modifying the Synapse configuration file (homeserver.yaml) and setting the email notifications to false:
email: enable_notif: false
Conclusion
The HTML injection vulnerability in Matrix Synapse notification emails poses a risk to user security and trust. Upgrading to version 1.27.0 or later is essential to mitigate this risk. Users should also consider disabling email notifications temporarily until the upgrade is complete.
See every vulnerability recorded for matrix-synapse →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
No, the account expiry feature is not enabled by default in Matrix Synapse.
If left unaddressed, this vulnerability could allow attackers to inject malicious content into notification emails, potentially leading to phishing attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
