Unauthorized Access to Room Membership in Matrix Synapse - CVE-2021-39164
Summary
CVE-2021-39164: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. Affects matrix-synapse across 2 version ranges.
< 1.41.1-1
< cb35df940a
Fixed in 1.41.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix is an open federated Instant Messaging and Voice over IP ecosystem that allows users to communicate across different platforms. The package 'matrix-synapse' serves as the reference homeserver implementation for the Matrix protocol, enabling users to create and manage rooms for communication. This package is designed to support various features such as group chats, voice calls, and more. However, it has a vulnerability that allows unauthorized users to access sensitive information about room memberships under specific conditions.
Vulnerability Detail
In versions 1.41.0 and prior of matrix-synapse, a vulnerability exists that allows unauthorized users to access the membership list of a room if they know the room's ID. This issue is particularly concerning for rooms with 'shared' history visibility, as it exposes the display names of members to users who should not have access. The vulnerability arises from insufficient access controls implemented in the homeserver, which can lead to privacy breaches and unauthorized information disclosure.
How To Fix
Minimum fixed version
1.41.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade matrix-synapseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators of servers that utilize a reverse proxy can block access to specific endpoints. This can be done by configuring the reverse proxy to deny requests to the following URLs:
- /_matrix/client/r0/rooms/{room_id}/members with 'at' query parameter
- /_matrix/client/unstable/rooms/{room_id}/members with 'at' query parameter. This approach may lead to a loss of functionality, so it should be considered a short-term solution until the upgrade is completed.
Conclusion
CVE-2021-39164 represents a significant security concern for users of the matrix-synapse package, allowing unauthorized access to room membership information. It is crucial for server administrators to upgrade to version 1.41.1 or later to mitigate this risk. Temporary workarounds can be employed, but they should not replace a proper update.
See every vulnerability recorded for matrix-synapse →
FAQ
CVE-2021-39164 is a vulnerability in the matrix-synapse package that allows unauthorized users to access the membership list of a room if they know the room ID.
Versions 1.41.0 and prior of matrix-synapse are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of CVE-2021-39164 is 3.1, indicating a low to moderate severity level.
If an immediate upgrade is not possible, consider implementing the mentioned workaround to block access to the vulnerable endpoints until you can perform the upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
