CVE-2021-21392 Open redirect via transitional IPv6 addresses on dual-stack networks
Attackers can force the Matrix homeserver to make requests to internal infrastructure on dual-stack networks via transitional IPv6 addresses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21392?
CVE-2021-21392 is a medium-severity server-side request forgery vulnerability in Fedoraproject Fedora, published on 12 Apr 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds.
Weakness: CWE-601
Which versions are affected by CVE-2021-21392?
3 open source packages ship an affected version, including matrix-synapse. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.28.0 |
matrix-synapse PyPI | All versions | 1.28.0rc1 |
matrix-synapse PyPI | All versions | 1.28.0rc1 |
Products include Fedoraproject Fedora, Matrix Synapse.
How do I fix CVE-2021-21392?
Upgrade matrix-synapse to a fixed version for your release line: 1.28.0 or 1.28.0rc1.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-21392 being exploited?
There is no known exploitation of CVE-2021-21392 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-5wrh-4jwv-5w78, PYSEC-2021-25, UBUNTU-CVE-2021-21392.