Open Redirect in Matrix Synapse
CVE-2021-21392
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
Vulnerability class: Open Redirect
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.009 (59.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 59.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Matrix Synapse
- Matrix-Org Synapse — versions < 1.28.0
- Fedoraproject Fedora — versions 34
Weakness classification (CWE)
References
- pypi.org/project/matrix-synapse/ (Product, Third Party Advisory)
- github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78 (Patch, Third Party Advisory)
- github.com/matrix-org/synapse/pull/9240 (Patch, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2021-21392?
- CVE-2021-21392 is a medium-severity vulnerability in Matrix Synapse, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.3/10. Published 2021-04-12.
- How severe is CVE-2021-21392?
- Medium severity. CVSS v3 base score is 6.3 out of 10.