Improper checks for deactivated users during login in synapse

Overview

CVE-2023-32682 affects Synapse, a Matrix homeserver. Under certain uncommon configurations, deactivated user accounts can still log in. This occurs either when JWT login is enabled (jwt_config.enabled) [1], or when the local password database is active (password_config.enabled and password_config.localdb_enabled) and an admin sets a new password for a deactivated user via the admin API [2].

Exploitation

No authentication is needed to trigger the vulnerability; an attacker simply needs to know the credentials of a deactivated account. For JWT-based login, the JWT handler did not check the account's deactivation status [3]. For password-based login, the flaw arises only if an administrator explicitly updates a user's password after deactivation. The bug was addressed in pull requests that consolidated deactivation checks [4]. Installations relying solely on SSO (CAS, SAML, OIDC) or external password providers are not affected [1][2].

Impact

An attacker who gains or knows the credentials of a deactivated user can authenticate and inherit the user's prior access to rooms and data, bypassing account deactivation intended to revoke access.

Mitigation

Users are advised to upgrade to Synapse version 1.85.0 or later, where the login checks are enforced. As a partial workaround, ensure deactivated users have no password set and avoid setting JWT tokens for such accounts.