github - ghsa-p6hw-wm59-3g5g

ghsa-p6hw-wm59-3g5g

Vulnerability from github

Published

2023-07-31 22:03

Modified

2023-08-04 18:41

Severity ?

9.3 (Critical) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Summary

Sydent does not verify email server certificates

Details

Impact

If configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails.

CVSS 3.1 overall score: 3.3 - AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N

Reported by Martin Schobert, Pentagrid AG.

Details

Sydent can be configured to send emails over a TLS-encrypted socket by setting

yaml email: tlsmode: "TLS" # or the legacy value "SSL"

in its config file. Alternatively it can be configured to use Opportunistic TLS by setting

yaml email: tlsmode: "STARTTLS"

In both situations, Sydent will encrypt its communication with the SMTP server when sending emails. In affected versions, Sydent will not verify the destination server's certificate.

Vulnerability

Sydent sends email for two purposes: - to inform a third party that they have been invited to a Matrix room by their email address; and - to verify that a given Matrix user controls an email address.

Therefore, attackers capable of running a MITM attack can

Intercept room invitations sent to an email address. The invitation includes
the room ID and its avatar, and
the inviter's username, displayname and their avatar, and
credentials for a guest Matrix account on the inviter's homeserver.
Intercept address ownership confirmation emails. This would allow the attacker to falsely claim ownership of the indented recipient's Matrix account, if that account was permitted to log in using an email address and no other authentication factors.

Patches

This is patched in Sydent 2.5.6, see PR https://github.com/matrix-org/sydent/pull/574.

When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. If you are using self-signed certificates, make sure to copy your Certification Authority certificate, or your self signed certificate if using only one, to the trust store of your operating system.

Workarounds

One can ensure Sydent's emails fail to send by setting the configured SMTP server to a loopback or non-routable address under your control which does not have a listening SMTP server. For example:

yaml email: smtphost: "localhost" # Assuming there is no SMTP server listening on localhost

References

https://github.com/matrix-org/sydent/pull/574 implements the fix.
https://github.com/matrix-org/sydent/releases/tag/v2.5.6 is the release including this fix.
https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations details the best-practice advice on how to use the standard library smtp module safely.
https://peps.python.org/pep-0476/ (accepted) proposed enabling TLS certificate verification by default in standard library HTTP clients.
https://github.com/python/cpython/issues/91826 discusses enabling TLS certificate verification by default in the Python standard library, for SMTP and other protocols.

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-sydent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T22:03:44Z",
    "nvd_published_at": "2023-08-04T16:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "## Impact\n\nIf configured to send emails using TLS, Sydent does not verify SMTP servers\u0027 certificates. This makes  Sydent\u0027s emails vulnerable to interception via a [man-in-the-middle (MITM) attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Attackers with privileged access to the network can intercept room invitations and address confirmation emails.\n\nCVSS 3.1 overall score: 3.3 - [AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N\u0026version=3.1)\n\n_Reported by Martin Schobert, [Pentagrid AG](https://pentagrid.ch/)._\n\n### Details\n\nSydent can be configured to send emails over a TLS-encrypted socket by setting\n\n```yaml\nemail:\n    tlsmode: \"TLS\"  # or the legacy value \"SSL\"\n```\n\nin its config file. Alternatively it can be configured to use [Opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) by setting\n\n```yaml\nemail:\n    tlsmode: \"STARTTLS\"\n```\n\nIn both situations, Sydent will encrypt its communication with the SMTP server when sending emails. **In affected versions, Sydent will not verify the destination server\u0027s certificate.**\n\n### Vulnerability \n\nSydent sends email for two purposes:\n- to inform a third party that they have been invited to a Matrix room by their email address; and\n- to verify that a given Matrix user controls an email address.\n\nTherefore, attackers capable of running a MITM attack can\n\n1. Intercept room invitations sent to an email address. The invitation includes \n   - the room ID and its avatar, and\n   - the inviter\u0027s username, displayname and their avatar, and\n   - credentials for a guest Matrix account on the inviter\u0027s homeserver.\n2. Intercept address ownership confirmation emails. This would allow the attacker to falsely claim ownership of the indented recipient\u0027s Matrix account, if that account was permitted to log in using an email address and no other authentication factors.\n\n\n### Patches\n\nThis is patched in [Sydent 2.5.6](https://github.com/matrix-org/sydent/releases/tag/v2.5.6), see PR https://github.com/matrix-org/sydent/pull/574.\n\nWhen patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. If you are using self-signed certificates, make sure to copy your Certification Authority certificate, or your self signed certificate if using only one, to the trust store of your operating system.\n\n### Workarounds\n\nOne can ensure Sydent\u0027s emails fail to send by setting the configured SMTP server to a loopback or [non-routable](https://datatracker.ietf.org/doc/html/rfc1918#section-3) address under your control which does not have a listening SMTP server. For example:\n\n```yaml\nemail:\n    smtphost: \"localhost\"  # Assuming there is no SMTP server listening on localhost\n```\n\n### References\n\n- https://github.com/matrix-org/sydent/pull/574 implements the fix.\n- https://github.com/matrix-org/sydent/releases/tag/v2.5.6 is the release including this fix.\n- https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations details the best-practice advice on how to use the standard library `smtp` module safely.\n- https://peps.python.org/pep-0476/ (accepted) proposed enabling TLS certificate verification by default  in standard library HTTP clients.\n- https://github.com/python/cpython/issues/91826 discusses enabling TLS certificate verification by default in the Python standard library, for SMTP and other protocols.\n\n## For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).",
  "id": "GHSA-p6hw-wm59-3g5g",
  "modified": "2023-08-04T18:41:16Z",
  "published": "2023-07-31T22:03:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/issues/91826"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/pull/574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/sydent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml"
    },
    {
      "type": "WEB",
      "url": "https://peps.python.org/pep-0476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sydent does not verify email server certificates"
}

pysec-2023-139

Vulnerability from pysec

Published

2023-08-04 16:15

Modified

2023-08-17 03:22

Severity ?

5.3 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent's emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one's control which does not have a listening SMTP server.

Impacted products

Name	purl
matrix-sydent	pkg:pypi/matrix-sydent

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-sydent",
        "purl": "pkg:pypi/matrix-sydent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1cd748307c6b168b66154e6c4db715d4b9551261"
            }
          ],
          "repo": "https://github.com/matrix-org/sydent",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0",
        "2.0.1",
        "2.1.0",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.4.5",
        "2.4.6",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.5.4",
        "2.5.5"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38686",
    "GHSA-p6hw-wm59-3g5g"
  ],
  "details": "Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers\u0027 certificates. This makes  Sydent\u0027s emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent\u0027s emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one\u0027s control which does not have a listening SMTP server.",
  "id": "PYSEC-2023-139",
  "modified": "2023-08-17T03:22:32.583512+00:00",
  "published": "2023-08-04T16:15:00+00:00",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/python/cpython/issues/91826"
    },
    {
      "type": "FIX",
      "url": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g"
    },
    {
      "type": "WEB",
      "url": "https://peps.python.org/pep-0476/"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/matrix-org/sydent/pull/574"
    },
    {
      "type": "FIX",
      "url": "https://github.com/matrix-org/sydent/pull/574"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-38686 (GCVE-0-2023-38686)

Vulnerability from cvelistv5

Published

2023-08-04 15:57

Modified

2024-10-08 17:50

Severity ?

9.3 (Critical) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Summary

References

►

URL

Tags

	https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g	x_refsource_CONFIRM
	https://github.com/python/cpython/issues/91826	x_refsource_MISC
	https://github.com/matrix-org/sydent/pull/574	x_refsource_MISC
	https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261	x_refsource_MISC
	https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations	x_refsource_MISC
	https://github.com/matrix-org/sydent/releases/tag/v2.5.6	x_refsource_MISC
	https://peps.python.org/pep-0476/	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	matrix-org	sydent	Version: < 2.5.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:46:56.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g"
          },
          {
            "name": "https://github.com/python/cpython/issues/91826",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/issues/91826"
          },
          {
            "name": "https://github.com/matrix-org/sydent/pull/574",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/sydent/pull/574"
          },
          {
            "name": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261"
          },
          {
            "name": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations"
          },
          {
            "name": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6"
          },
          {
            "name": "https://peps.python.org/pep-0476/",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://peps.python.org/pep-0476/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sydent",
            "vendor": "matrix",
            "versions": [
              {
                "lessThan": "2.5.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-38686",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T17:45:32.889405Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T17:50:55.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sydent",
          "vendor": "matrix-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers\u0027 certificates. This makes  Sydent\u0027s emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent\u0027s emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one\u0027s control which does not have a listening SMTP server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-04T15:57:15.760Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g"
        },
        {
          "name": "https://github.com/python/cpython/issues/91826",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python/cpython/issues/91826"
        },
        {
          "name": "https://github.com/matrix-org/sydent/pull/574",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/matrix-org/sydent/pull/574"
        },
        {
          "name": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261"
        },
        {
          "name": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations"
        },
        {
          "name": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6"
        },
        {
          "name": "https://peps.python.org/pep-0476/",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://peps.python.org/pep-0476/"
        }
      ],
      "source": {
        "advisory": "GHSA-p6hw-wm59-3g5g",
        "discovery": "UNKNOWN"
      },
      "title": "Sydent does not verify email server certificates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-38686",
    "datePublished": "2023-08-04T15:57:15.760Z",
    "dateReserved": "2023-07-24T16:19:28.363Z",
    "dateUpdated": "2024-10-08T17:50:55.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-p6hw-wm59-3g5g

Vulnerability from github

Impact

Details

Vulnerability

Patches

Workarounds

References

For more information

pysec-2023-139

Vulnerability from pysec

CVE-2023-38686 (GCVE-0-2023-38686)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature