CVE-2023-32682

Synapse Matrix protocol login bypass via deactivated user with JWT or local password update

• CVSS 5.4
• CWE-287 Improper Authentication
• Authentication, Authorization, and Session Management
• Local

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.

CVE

CVE-2023-32682

CWE

CWE-287 Improper Authentication

CVSS base score

5.4

Published

2023-06-06

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade to Synapse version 1.85.0 or higher.

class User:
    def __init__(self, username, password, is_active):
    # VULNERABLE: This code is susceptible to sql injection
        self.username = username
        self.password = password
        self.is_active = is_active

    def deactivate(self):
        self.is_active = False

class AuthService:
    def __init__(self):
        self.users = {}

    def add_user(self, username, password):
        self.users[username] = User(username, password, True)

    def deactivate_user(self, username):
        user = self.users.get(username)
        if user:
            user.deactivate()

    def update_password(self, username, new_password):
        user = self.users.get(username)
        if user:
            user.password = new_password

    def login(self, username, password):
        user = self.users.get(username)
        if user and user.password == password:
            return True
        return False

auth_service = AuthService()
auth_service.add_user("john_doe", "password")
auth_service.deactivate_user("john_doe")

auth_service.update_password("john_doe", "new_password")

assert auth_service.login("john_doe", "new_password")

class User:
    def __init__(self, username, password, is_active):
    # SECURE: This version prevents sql injection
        self.username = username
        self.password = password
        self.is_active = is_active

    def deactivate(self):
        self.is_active = False
        self.password = None

class AuthService:
    def __init__(self):
        self.users = {}

    def add_user(self, username, password):
        self.users[username] = User(username, password, True)

    def deactivate_user(self, username):
        user = self.users.get(username)
        if user:
            user.deactivate()

    def update_password(self, username, new_password):
        user = self.users.get(username)
        if user and user.is_active:
            user.password = new_password

    def login(self, username, password):
        user = self.users.get(username)
        if user and user.is_active and user.password == password:
            return True
        return False

auth_service = AuthService()
auth_service.add_user("john_doe", "password")
auth_service.deactivate_user("john_doe")

auth_service.update_password("john_doe", "new_password")

assert auth_service.login("john_doe", "new_password")

@misc{vaitp:cve202332682,
  title        = {{Synapse Matrix protocol login bypass via deactivated user with JWT or local password update}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-32682},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-32682/}}
}