CVE-2019-11340

Email domain-based registration restrictions bypass in Matrix Sydent < 1.0.2

• CVSS 5.9
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Remote

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.

CVE

CVE-2019-11340

CWE

CWE-20 Improper Input Validation

CVSS base score

5.9

Published

2019-04-19

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Matrix Sydent to version 1.0.2 or higher.

from email.utils import parseaddr

def handle_registration(email_str, allowed_domains):
    name, email = parseaddr(email_str)
    domain = email.split('@')[-1]
    
    if domain not in allowed_domains:
        raise ValueError("Email domain not allowed.")
    
    return f"Registration successful for {email}"

allowed_domains = {"good.example.com"}
try:
    print(handle_registration("user@bad.example.net@good.example.com", allowed_domains))
except ValueError as e:
    print(e)

from email.utils import parseaddr
import re

def handle_registration(email_str, allowed_domains):
    name, email = parseaddr(email_str)
    
    if not re.fullmatch(r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}", email):
        raise ValueError("Invalid email format.")
    
    parts = email.split('@')
    if len(parts) != 2:
        raise ValueError("Malformed email address.")
    
    domain = parts[1].lower()
    if domain not in allowed_domains:
        raise ValueError("Email domain not allowed.")
    
    return f"Registration successful for {email}"

allowed_domains = {"good.example.com"}
try:
    print(handle_registration("user@example.net@example.com", allowed_domains))
except ValueError as e:
    print(e)

@misc{vaitp:cve201911340,
  title        = {{Email domain-based registration restrictions bypass in Matrix Sydent < 1.0.2}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-11340},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-11340/}}
}