CVE-2023-32683

Synapse Matrix protocol server Python Twisted oEmbed/image URL bypass vulnerability

• CVSS 5.4
• CWE-918
• Configuration Issues
• Remote

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.

CVE

CVE-2023-32683

CWE

CWE-918

CVSS base score

5.4

Published

2023-06-06

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Server-Side Request Forgery (SSRF)

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to Synapse version 1.85.0 or higher.

def fetch_url_preview(url):
    response = requests.get(url)

    if is_oembed_url(url):
        process_oembed_response(response)
    elif is_image_url(url):
        process_image_response(response)
    else:
        raise ValueError("Unsupported URL type")

def is_oembed_url(url):
    return url.endswith('.json')

def is_image_url(url):
    return url.lower().endswith(('.png', '.jpg', '.jpeg', '.gif'))

def process_oembed_response(response):
    pass

def process_image_response(response):
    pass

import requests
from urllib.parse import urlparse
import ipaddress

def fetch_url_preview(url):
    if not is_valid_url(url):
        raise ValueError("Invalid or unsafe URL")

    try:
        response = requests.get(url, timeout=5, stream=True)
        content_type = response.headers.get('Content-Type', '').lower()

        if is_oembed_url(url, content_type):
            process_oembed_response(response)
        elif is_image_url(url, content_type):
            process_image_response(response)
        else:
            raise ValueError("Unsupported URL type")
    except requests.RequestException as e:
        raise ValueError(f"Request failed: {e}")

def is_valid_url(url):
    parsed = urlparse(url)
    if parsed.scheme not in ('http', 'https'):
        return False
    try:
        ip = ipaddress.ip_address(parsed.hostname)
        if ip.is_private or ip.is_loopback or ip.is_link_local:
            return False
    except ValueError:
        pass
    return True

def is_oembed_url(url, content_type):
    return url.endswith('.json') and 'application/json' in content_type

def is_image_url(url, content_type):
    return url.lower().endswith(('.png', '.jpg', '.jpeg', '.gif')) and 'image/' in content_type

def process_oembed_response(response):
    data = response.content[:2048]

def process_image_response(response):
    image_data = response.raw.read(2048)

@misc{vaitp:cve202332683,
  title        = {{Synapse Matrix protocol server Python Twisted oEmbed/image URL bypass vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-32683},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-32683/}}
}