Medium severity · published Apr 15, 2021
CVE-2021-29431
Sydent is a reference Matrix identity server
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sydent · Matrix
before 2.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29431
Patch
https://github.com/matrix-org/sydent/commit/0f00412017f25619bc36c264b29ea96808bf310a
Patch
https://github.com/matrix-org/sydent/commit/3d531ed50d2fd41ac387f36d44d3fb2c62dd22d3
Patch
https://github.com/matrix-org/sydent/commit/8936925f561b0c352c2fa922d5097d7245aad00a
Patch
https://github.com/matrix-org/sydent/commit/9e573348d81df8191bbe8c266c01999c9d57cd5f
Release Notes
https://github.com/matrix-org/sydent/releases/tag/v2.3.0
Patch
https://github.com/matrix-org/sydent/security/advisories/GHSA-9jhm-8m8c-c3f4
More from Sydent
7.5
CVE-2021-29430
Sydent is a reference Matrix identity server
7.5
CVE-2019-11842
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1
5.9
CVE-2019-11340
util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled
5.7
CVE-2021-29432
Sydent is a reference matrix identity server
5.3
CVE-2023-38686
Sydent does not verify email server certificates