CVE-2021-41281highCWE-22

CVE-2021-41281: high-severity vulnerability in matrix-org synapse

Path traversal in Matrix Synapse

Published · Updated

Follow this CVE+ Monitor synapse+ Monitor matrix-synapse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.6%
In short

Matrix Synapse's media repository can be tricked into downloading files to arbitrary directories on the server without authentication. While the final directory and filename are randomized, this could still allow an attacker to write files in unexpected locations.

Technical detail

Path traversal vulnerability in Synapse's media repository endpoint allows unauthenticated attackers to specify arbitrary download paths via traversal sequences (../); impact is mitigated by random selection of the last 2 directory levels and filename by Synapse. Affected only if media repository is enabled and no federation whitelist is configured; exploitation requires network access to the media endpoint.

Summary generated and translated by AI from the official description.
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
matrix-org · synapse
Related CVEs — matrix-org synapse

In the same product, most dangerous first.

CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2021-21274MEDIUMDenial of service attack via .well-known lookupsEPSS 2.2%CVE-2021-21273LOWOpen redirects on some federation and push requestsEPSS 1.8%CVE-2022-31052MEDIUMURL previews can crash Synapse media repositories or Synapse monolithsEPSS 1.7%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%