CVE-2021-21274

Synapse Matrix homeserver <1.25.0: Federation DoS via .well-known redirection

• CVSS 6.5
• CWE-770
• Resource Management
• Remote

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.

CVE

CVE-2021-21274

CWE

CWE-770

CVSS base score

6.5

Published

2021-02-26

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to Synapse version 1.25.0 or use the federation_domain_whitelist setting.

class SynapseHomeserver:
    def get_well_known_file(self, domain):
        response = self.fetch_well_known_file(domain)
        return response

    def fetch_well_known_file(self, domain):
        return f"Retrieved .well-known file from {domain}"



homeserver = SynapseHomeserver()

print(homeserver.get_well_known_file("server.com"))

import re
import socket
import ipaddress

class SynapseHomeserver:
    def get_well_known_file(self, domain):
        if not self.check_domain(domain):
            raise ValueError("Unsafe domain input detected.")
        response = self.fetch_well_known_file(domain)
        return response

    def check_domain(self, domain):
        if not re.fullmatch(r"[a-zA-Z0-9.-]+", domain):
            return False

        try:
            ip = socket.gethostbyname(domain)
            ip_obj = ipaddress.ip_address(ip)
            if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local:
                return False
        except Exception:
            return False

        return True

    def fetch_well_known_file(self, domain):
        return f"Retrieved .well-known file from {domain}"

homeserver = SynapseHomeserver()

print(homeserver.get_well_known_file("example.com"))

@misc{vaitp:cve202121274,
  title        = {{Synapse Matrix homeserver <1.25.0: Federation DoS via .well-known redirection}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21274},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21274/}}
}