Vulnerability Description
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Matrix | Sydent | < 2.3.0 |
Related Weaknesses (CWE)
References
- https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bfPatchThird Party Advisory
- https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62ddPatchThird Party Advisory
- https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aaPatchThird Party Advisory
- https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57PatchThird Party Advisory
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0Release NotesThird Party Advisory
- https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4PatchThird Party Advisory
- https://pypi.org/project/matrix-sydent/ProductThird Party Advisory
- https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bfPatchThird Party Advisory
- https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62ddPatchThird Party Advisory
- https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aaPatchThird Party Advisory
- https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57PatchThird Party Advisory
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0Release NotesThird Party Advisory
- https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4PatchThird Party Advisory
- https://pypi.org/project/matrix-sydent/ProductThird Party Advisory
FAQ
What is CVE-2021-29431?
CVE-2021-29431 is a vulnerability with a CVSS score of 7.7 (HIGH). Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to...
How severe is CVE-2021-29431?
CVE-2021-29431 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-29431?
Check the references section above for vendor advisories and patch information. Affected products include: Matrix Sydent.