CVE-2021-41281: Path Traversal in Matrix Synapse

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Matrix Synapse is an open-source messaging protocol and server implementation that enables decentralized communication. It allows users to exchange messages, media files, and participate in group chats. The vulnerability identified as CVE-2021-41281 affects instances of Matrix Synapse with the media repository enabled. This vulnerability can be exploited to trick the server into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. However, the impact is limited as the last two directories and file name of the path are randomly chosen by Synapse and cannot be controlled by an attacker. Homeservers with the media repository disabled or configured with a federation whitelist are not affected.

Vulnerability Detail

The path traversal vulnerability in Matrix Synapse allows an attacker to manipulate the server into downloading a file from a remote server and saving it in an unintended directory. By exploiting this vulnerability, an attacker could potentially bypass security measures and store malicious files outside the designated media store directory. However, the impact is mitigated by the fact that the last two directories and file name of the path are randomly generated by Synapse and cannot be controlled by the attacker. This limits the potential harm that can be caused.

pip install --upgrade "matrix-synapse==1.163.0"

pip install --upgrade "matrix-synapse==1.47.1"

Workaround

Server administrators using a reverse proxy can implement a workaround by blocking specific endpoints. By blocking the following endpoints, media functionality will be lost but the vulnerability can be mitigated:

• /_matrix/media/r0/download/{serverName}/{mediaId}
• /_matrix/media/r0/download/{serverName}/{mediaId}/{fileName}
• /_matrix/media/r0/thumbnail/{serverName}/{mediaId}

Alternatively, non-containerized deployments can adapt to use the hardened systemd config located at contrib/systemd/override-hardened.conf. This configuration provides additional security measures that can help mitigate the vulnerability.

Conclusion

The path traversal vulnerability in Matrix Synapse can be mitigated by upgrading to version 1.47.1 or later. Server administrators should promptly apply the necessary patches to ensure the security of their Matrix Synapse instance. Additionally, the provided workarounds can be implemented to mitigate the vulnerability in specific deployment scenarios. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for matrix-synapse →

FAQ