CVE-2021-21392

Synapse Matrix server Unrestricted requests to user-provided domains with transitional IPv6 addresses

• CVSS 6.3
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• Input Validation and Sanitization
• Remote

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.

CVE

CVE-2021-21392

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSS base score

6.3

Published

2021-04-12

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Synapse to version 1.28.0 or higher.

import requests

def make_request_to_domain(domain):
    response = requests.get(domain)
    return response.content

domain = "http://example.com"
make_request_to_domain(domain)

import requests
from urllib.parse import urlparse

ALLOWED_DOMAINS = ["example.com", "example.org"]

def is_valid_url(url):
    try:
        parsed_url = urlparse(url)
        return parsed_url.scheme in ["http", "https"] and parsed_url.netloc
    except Exception:
        return False

def make_request_to_domain(domain):
    if not is_valid_url(domain):
        raise ValueError("Invalid URL format")

    parsed_domain = urlparse(domain)

    if parsed_domain.netloc not in ALLOWED_DOMAINS:
        raise ValueError(f"Domain {parsed_domain.netloc} is not allowed")

    try:
        response = requests.get(domain, timeout=10)
        return response.content
    except requests.exceptions.RequestException as e:
        raise ValueError(f"An error occurred while making the request: {e}")


domain = "http://example.com"
try:
    result = make_request_to_domain(domain)
    print(result)
except ValueError as e:
    print(f"Error: {e}")

@misc{vaitp:cve202121392,
  title        = {{Synapse Matrix server Unrestricted requests to user-provided domains with transitional IPv6 addresses}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21392},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21392/}}
}