CVE-2021-29471

Synapse Matrix 1.33.2 Push rules Denial-of-Service (DoS) via event_match

• CVSS 5.3
• CWE-331 Insufficient Entropy
• Resource Management
• Remote

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.

CVE

CVE-2021-29471

CWE

CWE-331 Insufficient Entropy

CVSS base score

5.3

Published

2021-05-11

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to Synapse version 1.33.2 or higher.

def process_push_rule(push_rule):
    if 'event_match' in push_rule:
        pattern = push_rule['event_match']
        match_events(pattern)

def match_events(pattern):
    events = get_events()
    for event in events:
        if matches_pattern(event, pattern):
            handle_matched_event(event)

def matches_pattern(event, pattern):
    return pattern in event['content']

push_rule = {
    'event_match': 'some*complex?pattern'
}
process_push_rule(push_rule)

import re

def process_push_rule(push_rule):
    if 'event_match' in push_rule:
        pattern = push_rule['event_match']
        regex = convert_wildcard_to_regex(pattern)
        match_events(regex)

def match_events(regex):
    events = get_events()
    for event in events:
        if matches_pattern(event, regex):
            handle_matched_event(event)

def matches_pattern(event, regex):
    content = event.get('content', '')
    return bool(regex.search(content))

def convert_wildcard_to_regex(pattern):
    if not isinstance(pattern, str) or len(pattern) > 256:
        raise ValueError("Invalid or overly long pattern")

    pattern = re.escape(pattern)
    pattern = pattern.replace(r'\*', '.*').replace(r'\?', '.')
    return re.compile(f"^{pattern}$", re.IGNORECASE)

def get_events():
    return [
        {'content': 'some interesting content'},
        {'content': 'something else'},
        {'content': 'someComplexPattern match here'},
    ]

def handle_matched_event(event):
    print("Matched event:", event)

push_rule = {
    'event_match': 'some*complex?pattern'
}
process_push_rule(push_rule)

@misc{vaitp:cve202129471,
  title        = {{Synapse Matrix 1.33.2 Push rules Denial-of-Service (DoS) via event_match}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-29471},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-29471/}}
}