CVE-2021-29431 SSRF in Sydent due to missing validation of hostnames

2021-04-1521:00:16

CWE-20

CWE-918

GitHub_M

www.cve.org

sydent

ssrf

missing validation

hostnames

http

internal systems

parameter validation

ip address

blacklisting

exfiltrate data

control request headers

port enumeration

9e57334

8936925

3d531ed

0f00412

workaround

firewall

http resources

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

42.3%

JSON

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

CNA Affected

[
  {
    "product": "sydent",
    "vendor": "matrix-org",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.3.0"
      }
    ]
  }
]