CVE-2021-21393

Input validation missing in Synapse (before v1.28.0) for third-party identifier confirmation endpoints

• CVSS 6.5
• CWE-20 Improper Input Validation
• Resource Management
• Remote

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds.

CVE

CVE-2021-21393

CWE

CWE-20 Improper Input Validation

CVSS base score

6.5

Published

2021-04-12

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Synapse to version 1.28.0 or higher.

from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/confirm_identifier', methods=['POST'])
def confirm_identifier():
    identifier = request.json.get('identifier')
    return jsonify({"status": "success", "identifier": identifier}), 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request, jsonify

app = Flask(__name__)

MAX_IDENTIFIER_LENGTH = 255

def validate_third_party_identifier(identifier):
    if len(identifier) > MAX_IDENTIFIER_LENGTH:
        raise ValueError(f"Identifier exceeds maximum length of {MAX_IDENTIFIER_LENGTH} characters.")

@app.route('/confirm_identifier', methods=['POST'])
def confirm_identifier():
    try:
        identifier = request.json.get('identifier')
        validate_third_party_identifier(identifier)
        return jsonify({"status": "success", "identifier": identifier}), 200
    except ValueError as e:
        return jsonify({"error": str(e)}), 400
    except Exception as e:
        return jsonify({"error": "An unexpected error occurred."}), 500

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202121393,
  title        = {{Input validation missing in Synapse (before v1.28.0) for third-party identifier confirmation endpoints}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21393},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21393/}}
}