Dendrite IDOR in 3pid delete allows removing other users' identifiers

The following is a summary of key vulnerability information based on the provided web page screenshots: --- Vulnerability Overview Vulnerability 1: IDOR in allows any authenticated user to delete other users' third-party identifiers Affected Versions: All versions, including 0.13.8 (latest release) and HEAD 0841813 (2024-11-25). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (6.5 Medium) CWE: CWE-639 Authorization Bypass Through User-Controlled Key Summary: The Matrix Client-Server API endpoint accepts an email address (or phone number) from the request body to unbind the third-party identifier from its associated local user account. The handler verifies the caller but never checks whether the provided address actually belongs to the caller. Any logged-in user, including low-privilege guest accounts, can delete the email addresses of other local user accounts. After the binding is removed, the user loses the ability to reset their password via that 3PID. The attacker can now control the orphaned address record in the upstream identity server and rebind it to their own account, allowing the user account’s "reset password" flow to take over the victim’s account. Details: Vulnerable Handler: lines 213 to 235 Route Registration: lines 954 to 958 Internal API: lines 973 to 975 Storage Layer: lines 55 to 56 POC: Impact: Enumerate or guess another user's email address and unbind it via a single POST request. Remove every 3PID from every other user's home page by iterating through known addresses. Permanently destroy account recovery for users who rely on their email for password resets (Synapse-compatible flows depend on 3PID bindings). By combining with fresh verification and binding of the email address, rebind the address to the attacker's account via the identity server, triggering Dendrite's standard "reset password" flow to take over the victim's account. Severity: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) --- Vulnerability 2: Unauthenticated SSRF and internal port scanning via legacy Affected Versions: <=0.13.8 (latest release) and HEAD 0841813 (2024-11-25). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (5.3 Medium) CWE: CWE-918 Server-Side Request Forgery, CWE-200 Information Exposure in the Error Path Summary: The legacy unauthenticated media download endpoint accepts arbitrary server names and, when the media is not locally cached, instructs federation clients to fetch it from that server. Federation server name resolution in accepts raw IP literals and arbitrary strings, without blocklists or filtering for RFC1918/loopback/media, allowing unauthenticated attackers to force the Dendrite process to open outbound HTTPS connections to any host and port reachable within the server's network namespace. JSON error responses leak resolved internal IP addresses, effectively turning the endpoint into a fully unauthenticated internal port scanner and DNS resolver. Details: Route Registration (without auth wrapper): lines 99 to 105 Outbound Fetch: lines 821 to 843 Resolver: lines 47 to 78 POC: Impact: Unauthenticated network reconnaissance from any source that can reach the Matrix Client API, allowing mapping of the operator's internal network and resolution of internal hostnames to internal IPs. Forces outbound TLS connections through network segmentation, bypassing the operator's external firewall (which typically allows arbitrary outbound TLS on port 443 by default) as it does not filter them. HTTPS-only transmission limits do not prevent direct reading of plaintext internal services, but TLS-fronted internal services (metadata proxies, admin dashboards, staging deployments) can be probed for status codes. The legacy endpoint is unauthenticated for compatibility with pre-v1.11 Matrix client specifications, meaning this action requires no account, capture, or rate-limiting surviving workflows. Severity: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) --- Vulnerability 3: returns current room state to non-members and leavers (history visibility bypass) Affected Versions: Confirmed in commit 0841813 (v0.13.x branch, ~5.7k stars). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N (5.3 Medium) CWE: CWE-863 Incorrect Authorization (with CWE-200) Summary: The endpoint returns the room's current state without member or history visibility filtering. The membership check degrades to "does this room exist on this server," and the requested events and timeline are filtered by history visibility, but the is not. Local users who have left a private room (default history visibility) can re-read state events created after they left, such as new topics/names/avatars and the current member list, whereas and are correctly filtered. Details: Vulnerable Handler: lines 100 to 120 Route Registration: lines 150 to 160 Internal API: lines 200 to 220 POC: Impact: Non-members and leavers can read the room's current state, including new topics/names/avatars and the current member lis

Goal Reached Thanks to every supporter — we hit 100%!

Dendrite IDOR in 3pid delete allows removing other users' identifiers

More from this source