Vulnerability · Published Apr 15, 2021 · Assigned by GitHub_M
CVE-2021-29431SSRF in Sydent due to missing validation of hostnames
High 7.7
In plain English
A high-severity improper input validation in sydent from matrix-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | matrix-sydent | 2.3.0 | GHSA-9jhm-8m8c-c3f4 |
| PyPI | matrix-sydent | 2.3.0 | PYSEC-2021-22 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | sydent | < 2.3.0 |
Weakness: CWE-20, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://pypi.org/project/matrix-sydent/ x_refsource_MISC
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0 x_refsource_MISC
- https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4 x_refsource_CONFIRM
- https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f x_refsource_MISC
- https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a x_refsource_MISC
- https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3 x_refsource_MISC
- https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a x_refsource_MISC