CVE-2021-21274 Denial of service attack via .well-known lookups
A malicious homeserver can cause resource exhaustion in Synapse by redirecting .well-known requests to large files, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21274?
CVE-2021-21274 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 26 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
Which versions are affected by CVE-2021-21274?
3 open source packages ship an affected version, including matrix-synapse. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | From 0.99.0 | 1.25.0 |
matrix-synapse PyPI | From 0.99.0 | 1.25.0 |
matrix-synapse PyPI | From 0.99.0 | 1.25.0 |
Products include Fedoraproject Fedora, Matrix Synapse.
How do I fix CVE-2021-21274?
Upgrade matrix-synapse to 1.25.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21274 being exploited?
There is no known exploitation of CVE-2021-21274 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-2hwx-mjrm-v3g8, PYSEC-2021-132, UBUNTU-CVE-2021-21274.