CVE-2023-32683 - Synapse URL Preview Blacklist Bypass and Potential SSRF

CVE-2023-32683 is a security vulnerability affecting Synapse, an open-source Matrix homeserver implemented in Python with the Twisted framework. This bug centers on the handling of URL previews, a feature designed to give chat users previews of links they share. In certain cases, a flaw allows attackers to bypass blacklisting controls, potentially triggering server-side request forgery (SSRF) or evading network restrictions.

In this exclusive post, we’ll break down how this flaw works, show simple code snippets for context, and offer up-to-date mitigations. We’ll keep things straightforward—no jargon, just what you need to know.

What Is Synapse’s URL Preview?

Synapse lets users share links in a chat, showing a preview (image, title, etc.) by automatically fetching content from the link’s URL server-side. To prevent abuse (e.g., reading internal resources), Synapse admins can set a “URL blacklist” so previews won’t fetch blacklisted domains or IP addresses.

Here’s the relevant config excerpt

url_preview_enabled: true
url_preview_url_blacklist:
  - "127...1"
  - "10.../8"
  - "192.168../16"
url_preview_ip_range_blacklist:
  - "127...1"
  - "10.../8"
  - "192.168../16"

This blocks URL previews for localhost and private networks, helping stop SSRF.

The Bug: oEmbed and Image URL Bypass of Blacklist

The flaw lies in how Synapse discovers oEmbed or image URLs from the original link. If the discovered URL isn’t checked against the blacklist, an attacker could craft or find a website that points an oEmbed or image element to a blacklisted location (like an internal web service).

Technical summary:
- When Synapse fetches a URL for a preview, it sometimes finds secondary URLs (like oEmbed or images) in the page.
- These discovered URLs could bypass the admin-set url_preview_url_blacklist policy and be fetched by the server.

Potential Impact:
- Server-Side Request Forgery (SSRF): Attackers might use Synapse to read certain URLs unrestricted by firewall, like a metadata service or admin page on your network.
- Policy Evasion: Even if you set blacklists, in some cases Synapse still fetches blacklisted content.

Limitations:
- Previews are filtered: Only images (for image URLs) or valid oEmbed JSON responses are sent to users.

Let’s step through a theoretical exploit.

Suppose your internal company service lives at “http://10...5/admin” (private IP, blacklisted). Here’s how an attacker might craft their attack:

1. Malicious Webpage: Host a page that contains an oEmbed link or image tag pointing to http://10...5/admin.

Fetching: Synapse fetches the public page, discovers the oEmbed or image URL.

4. Bypass: Due to the bug, Synapse fetches http://10...5/admin through its backend, even though it’s blacklisted.
5. Leak (limited): If the response is an image or valid oEmbed JSON, content is revealed—in most cases, only metadata or a generic image is exposed.

Simple simulation

# Pseudo-code showing the bug's logic
if url in blacklist:
    # Skip fetching, as intended
    skip()
else:
    html = fetch(url)
    for discovered_url in get_oembed_or_image_urls(html):
        # The bug: should be checked against blacklist!
        result = fetch(discovered_url)  # SSRF possible here

1. Upgrade Now

Synapse fixed this bug in version 1.85..
*Upgrade if you can.*
Official release notes and upgrade guide

Edit your configuration

url_preview_enabled: false

b) Tighten Network Egress Rules

Configure firewalls so your Synapse server can’t reach sensitive internal resources, especially those not meant to be public.

Full Details & References

- Official security advisory
- Synapse release announcement
- Matrix protocol documentation: URL Previews

Final Word

If you run a Matrix Synapse homeserver, you must review your preview settings and ensure you’re patched. While the leak is typically limited, attackers are always looking for chaining opportunities—don’t be a target!

If upgrading isn’t in the cards, disabling previews is a solid quick fix. Stay secure, and check your open ports!

*Written exclusively for you. If you found this helpful, please help others by sharing the link and keeping your software up to date.*

Timeline

Published on: 06/06/2023 19:15:00 UTC
Last modified on: 06/17/2023 03:15:00 UTC