Matrix/Dendrite IDOR, SSRF, and Info Disclosure Vulnerabilities

The following is a summary of key vulnerability information based on the provided web page screenshot: --- Vulnerability Overview Vulnerability 1: IDOR in allows any authenticated user to delete another user's third-party identifier Affected Versions: All versions, including 0.13.8 (latest release) and HEAD 0841813 (2024-11-25). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (6.5 Medium) CWE: CWE-639 Authorization Bypass Through User-Controlled Key Detailed Description: The Matrix Client-Server API endpoint accepts an email address (or phone number) and unbinds that third-party identifier from the request body. The handler verifies the caller but never checks whether the provided address actually belongs to the caller. Any logged-in user (including low-privilege guest accounts) can delete another user's email or MSISDN binding. Remediation: Verify that the address belongs to the caller before performing the deletion. Vulnerability 2: Unauthenticated SSRF and internal port scanning via legacy Affected Versions: All versions, including 0.13.8 (latest release) and HEAD 0841813 (2024-11-25). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) CWE: CWE-918 Server-Side Request Forgery, with CWE-200 information exposure in the error path Detailed Description: The legacy unauthenticated media download endpoint accepts an arbitrary server name and, if the media is not locally cached, instructs federated clients to fetch it from that server name. Federated server name resolution in accepts raw IP addresses and arbitrary host port strings, bypassing RFC1918/loopback/media filtering. Unauthenticated attackers can force the Dendrite process to initiate outbound HTTPS connections to any host and port within the server's network namespace. JSON error responses leak the resolved IP address, turning the endpoint into a full unauthenticated internal port scanner and DNS resolver. Remediation: Filter before calling , rejecting private/loopback/link-local addresses and rejecting hostnames whose AAAA records resolve to these ranges. Vulnerability 3: endpoint returns current room state to non-members and left users (history visibility bypass) Affected Versions: Confirmed on the 0.13.x branch, approx. 5.7k stars. CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) CWE: CWE-863 Incorrect Authorization (with CWE-200) Detailed Description: The endpoint returns the current room state without filtering by membership or history visibility. Membership checks degrade to "does this room exist on this server," while the requested events and timeline are filtered by history visibility, but the state block is not. A local user can re-add a left user from a private room (which defaults to shared history visibility) as the current user, along with the new username/avatar and current members, with the state correctly corrected. Remediation: Verify that the user is a current member before returning the state. --- POC Code Vulnerability 1 POC Vulnerability 2 POC --- Impact Summary Vulnerability 1: Allows any authenticated user to delete another user's third-party identifier, potentially causing account recovery issues. Vulnerability 2: Unauthenticated SSRF and internal port scanning, potentially leading to internal network information disclosure. Vulnerability 3: Returns current room state to non-members and left users, potentially leading to privacy leaks. --- Above is the summary of key vulnerability information based on the web page screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Matrix/Dendrite IDOR, SSRF, and Info Disclosure Vulnerabilities

More from this source