matrix synapse 指向未可信站点的url重定向（开放重定向）

CVE编号

CVE-2021-21273

利用情况

暂无

补丁情况

官方补丁

披露时间

2021-02-27

漏洞描述

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/matrix-org/synapse/commit/30fba6210834a4ecd91badf0c8f3eb278b72e746
https://github.com/matrix-org/synapse/pull/8821
https://github.com/matrix-org/synapse/releases/tag/v1.25.0
https://github.com/matrix-org/synapse/security/advisories/GHSA-v936-j8gp-9q3p
https://lists.fedoraproject.org/archives/list/[email protected]...

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	matrix	synapse	*		Up to (excluding) 1.25.0
	运行在以下环境
	系统	fedora_34	matrix-synapse	*		Up to (excluding) 1.38.1-1.fc34

阿里云评分 3.6

• 攻击路径 远程
• 攻击复杂度 容易
• 权限要求 无需权限
• 影响范围 有限影响
• EXP成熟度 未验证
• 补丁情况 官方补丁
• 数据保密性 数据泄露
• 数据完整性 无影响
• 服务器危害 无影响
• 全网数量 N/A

CWE-ID 漏洞类型 CWE-601 指向未可信站点的URL重定向（开放重定向）