CVE-2021-41281

Synapse Python 3/Twisted homeservers download from remote servers without authentication

• CVSS 7.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.

CVE

CVE-2021-41281

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2021-11-23

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade to Synapse version 1.47.1 or later.

import os
import urllib.request

def download_file(url):
    save_directory = "/var/media/" 
    file_name = "random_file_name.txt"
    save_path = os.path.join(save_directory, file_name)

    urllib.request.urlretrieve(url, save_path)

download_file("http://example.com/file.txt")

import os
import urllib.request

def download_file(url):
    if not is_valid_url(url):
        raise ValueError("Invalid URL")

    save_directory = "/var/media/"
    file_name = os.path.basename(url)
    path = os.path.join(save_directory, file_name)

    urllib.request.urlretrieve(url, path)

def is_valid_url(url):
    return url.startswith("http://") or url.startswith("https://")

try:
    download_file("http://example.com/file.txt")
except Exception as e:
    print(f"An error occurred: {e}")

@misc{vaitp:cve202141281,
  title        = {{Synapse Python 3/Twisted homeservers download from remote servers without authentication}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-41281},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-41281/}}
}