Lucene search

GitHub Advisory DatabaseGHSA-9JHM-8M8C-C3F4

HistoryApr 19, 2021 - 2:54 p.m.

SSRF in Sydent due to missing validation of hostnames

2021-04-1914:54:15

CWE-20

CWE-918

GitHub Advisory Database

github.com

ssrf

sydent

http

validation

hostname

impact

patches

workaround

firewall

security advisory

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

42.3%

JSON

Impact

Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting.

It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration.

Patches

Fixed in 9e57334, 8936925, 3d531ed, 0f00412

Workarounds

A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

For more information

If you have any questions or comments about this advisory, email us at [email protected].

Affected configurations

Vulners

Node

matrixsydentRange<2.3.0

VendorProductVersionCPE
matrixsydent*cpe:2.3:a:matrix:sydent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
matrix	sydent	*	cpe:2.3:a:matrix:sydent::::::::

References

github.com/advisories/GHSA-9jhm-8m8c-c3f4

github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a

github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3

github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a

github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f

github.com/matrix-org/sydent/releases/tag/v2.3.0

github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4

github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2021-22.yaml

nvd.nist.gov/vuln/detail/CVE-2021-29431

pypi.org/project/matrix-sydent

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

42.3%

JSON

Related for GHSA-9JHM-8M8C-C3F4