PT-2021-14473

CVE-2021-21394

Published

2021-02-25

Updated

2021-11-23

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.28.0

Description The issue is caused by missing input validation of some parameters on the endpoints used to confirm third-party identifiers, which could lead to excessive use of disk space and memory, resulting in resource exhaustion. The affected endpoints include "/ matrix/client/(r0|unstable)/register/email", "/ matrix/client/(r0|unstable)/register/msisdn", "/ matrix/client/(r0|unstable)/account/password", and "/ matrix/client/(r0|unstable)/account/3pid".

Recommendations For versions prior to 1.28.0, consider the following workarounds:

Disable using email as third-party identifiers by not configuring the email setting.
Disable using phone numbers as third-party identifiers by ensuring that account threepid delegates.msisdn is not configured.
Block the affected endpoint patterns at a reverse proxy, including "^/ matrix/client/(r0|unstable)/register/email", "^/ matrix/client/(r0|unstable)/register/msisdn", "^/ matrix/client/(r0|unstable)/account/password", and "^/ matrix/client/(r0|unstable)/account/3pid". Update to version 1.28.0 or later to fix the issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2021-21394

GHSA-W9FG-XFFH-P362

ALT-PU-2021-1402