AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the     session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is     hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web     or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints. (CVE-2020-26891)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the
    session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is
    hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web
    or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints. (CVE-2020-26891)

Matrix developers reports :

The fallback authentication endpoint served via Synapse were vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

ID	Name	Product	Family	Severity
256459	Linux Distros Unpatched Vulnerability : CVE-2020-26891	Nessus	Misc.	medium
427670	Alpine: multiple synapse packages: security update to 1.21.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
427670	Alpine: multiple synapse packages: security update to 1.21.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
409761	SCA: security update for matrix-synapse (GHSA-3x8c-fmpc-5rmq)	Tenable Cloud Security	SCA Checks	medium
409761	SCA: security update for matrix-synapse (GHSA-3x8c-fmpc-5rmq)	Tenable Self-Hosted Container Security	SCA Checks	medium
141517	FreeBSD : py-matrix-synapse -- XSS vulnerability (5f39d80f-107c-11eb-8b47-641c67a117d8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-26891

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium