CVE-2021-29431highCWE-20CWE-918

CVE-2021-29431: high-severity vulnerability in matrix-org sydent

SSRF in Sydent due to missing validation of hostnames

Published · Updated

Follow this CVE+ Monitor sydent+ Monitor matrix-sydent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 1.2%
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
matrix-org · sydent
Related CVEs — matrix-org sydent

In the same product, most dangerous first.

CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2021-29432MEDIUMMalicious users could control the content of invitation emailsEPSS 0.9%CVE-2021-29433MEDIUMDenial of service (via resource exhaustion) due to improper input validationEPSS 0.9%CVE-2023-38686CRITICALSydent does not verify email server certificatesEPSS 0.3%