Log in Start free

Vulnerability · Published Feb 26, 2021 · Assigned by GitHub_M

CVE-2021-21273Open redirects on some federation and push requests

Low 3.1

In plain English

A low-severity open redirect in synapse from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)1.8%top 21.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14matrix-synapse1.25.0-1DEBIAN-CVE-2021-21273
PyPImatrix-synapse1.25.0GHSA-v936-j8gp-9q3p
PyPImatrix-synapse1.25.0PYSEC-2021-131

Affected products (as reported)

VendorProductVersions
matrix-org synapse < 1.25.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References