Dendrite Vulnerability Advisory: IDOR, SSRF, and Authorization Bypass

The following is a summary of the key vulnerability information based on the provided web page screenshots: --- Vulnerability Overview 1. IDOR in POST /account/3pid/delete allows any authenticated user to delete other users' third-party identifiers - Affected Versions: <0.13.8 (latest release) and HEAD 0841813 (2024-11-25) - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (6.5 Medium) - CWE: CWE-639 Authorization Bypass Through User-Controlled Key 2. Unauthenticated SSRF and internal port scanning via legacy /_matrix/media/r0/download - Affected Versions: <0.13.8 (latest release) and HEAD 0841813 (2024-11-25) - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (5.3 Medium) - CWE: CWE-918 Server-Side Request Forgery, with CWE-200 information exposure in the error path 3. /context endpoint returns current room state for non-members and left users (historical visibility bypass) - Affected Versions: Confirmed in commit 0841813 (v0.13.x branch, ~5.7k stars) - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.3 Medium) - CWE: CWE-863 Incorrect Authorization (with CWE-200) --- Impact Scope 1. IDOR Vulnerability - Any authenticated user can enumerate or guess another user's email address and unbind it with a single POST request. - Each 3PID can be removed from every other user by iterating through known addresses. - It can permanently break account recovery for users who rely on their email for password resets. - Combined with "fresh" validation and binding, addresses can be rebound to the attacker's account on the same email, triggering Dendrite's standard "reset password" flow and allowing the attacker to take over the victim's account. 2. SSRF and Internal Port Scanning Vulnerability - Unauthenticated network reconnaissance can be performed from any source that can access the Matrix client API. - Forcing outbound TLS connections through the destination's tunnel allows arbitrary outbound TLS on port 443. - When only transporting TLS, plaintext internal services can be read directly, but internal services with a TLS frontend (metadata proxies, admin dashboards, staging deployments) can be probed for status codes. - The legacy endpoint requires no account, captcha, or authentication for compatibility with pre-v1.11 Matrix clients. 3. Historical Visibility Bypass Vulnerability - Local users can downgrade the state block of a private room to "does this room exist on this server," while the requested events and timeline are filtered by historical visibility. - Local users can downgrade the state block of a private room to "does this room exist on this server," while the requested events and timeline are filtered by historical visibility. --- Remediation 1. IDOR Vulnerability - Ensure that when deleting a 3PID, only the 3PID belonging to the current user is deleted. 2. SSRF and Internal Port Scanning Vulnerability - Filter before calling in , rejecting loopback IPs, link-local addresses, multicast, IPv4-mapped IPv6, or any allow/deny lists. - Stop resolving addresses into error messages returned to the client. 3. Historical Visibility Bypass Vulnerability - Ensure the endpoint only returns state for members and the current room state, not for non-members and left users regarding historical visibility. --- POC Code IDOR Vulnerability POC SSRF and Internal Port Scanning Vulnerability POC --- The above is a summary of the key vulnerability information based on the provided web page screenshots.

Goal Reached Thanks to every supporter — we hit 100%!

Dendrite Vulnerability Advisory: IDOR, SSRF, and Authorization Bypass

More from this source