CVE-2021-29431 (Python, published 2021-04-15T21:15Z)
Description: value: Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/matrix-org/sydent
Files changed:
sydent/hs_federation/verifier.py
sydent/http/servlets/registerservlet.py
sydent/threepid/bind.py
sydent/util/stringutils.py
tests/test_register.py
tests/test_util.py
Commit message: Allow IPv6 literals as Matrix server names.

According to the spec, Matrix server names are allowed to be IP
addresses, including IPv6 literals.


Vulnerable code:
from sydent.util.stringutils import is_valid_hostname
        if not is_valid_hostname(json_request["origin"]):
            raise InvalidServerName("X-Matrix header's origin parameter must be a valid hostname")
from sydent.util.stringutils import is_valid_hostname
        if not is_valid_hostname(matrix_server):
                'error': 'matrix_server_name must be a valid hostname'
        if not is_valid_hostname(user_id_server):
from sydent.util.stringutils import is_valid_hostname
        if not is_valid_hostname(matrix_server):
                "MXID server part '%s' not a valid hostname. Not retrying.",
            except Exception as e:
# hostname/domain name + optional port
    """Validate that a given string is a valid hostname or domain name, with an
    optional port number.
    instance, it doesn't check that the TLD is valid). If a port is
    specified, it has to be a valid port number.
    host_parts = string.split(":", 1)
    if len(host_parts) == 1:
        return hostname_regex.match(string) is not None
    else:
        host, port = host_parts
        valid_hostname = hostname_regex.match(host) is not None
        try:
            valid_port = (
                port == str(port_num)  # exclude things like '08090' or ' 8090'
                and 1 <= port_num < 65536)
        except ValueError:
            valid_port = False
        return valid_hostname and valid_port
from sydent.util.stringutils import is_valid_hostname
    def test_is_valid_hostname(self):
        """Tests that the is_valid_hostname function accepts only valid
        hostnames (or domain names), with optional port number.
        self.assertTrue(is_valid_hostname("example.com"))
        self.assertTrue(is_valid_hostname("EXAMPLE.COM"))
        self.assertTrue(is_valid_hostname("ExAmPlE.CoM"))
        self.assertTrue(is_valid_hostname("example.com:4242"))
        self.assertTrue(is_valid_hostname("localhost"))
        self.assertTrue(is_valid_hostname("localhost:9000"))
        self.assertTrue(is_valid_hostname("a.b:1234"))
        self.assertFalse(is_valid_hostname("example.com:65536"))
        self.assertFalse(is_valid_hostname("example.com:0"))
        self.assertFalse(is_valid_hostname("example.com:a"))
        self.assertFalse(is_valid_hostname("example.com:04242"))
        self.assertFalse(is_valid_hostname("example.com: 4242"))
        self.assertFalse(is_valid_hostname("example.com/example.com"))
        self.assertFalse(is_valid_hostname("example.com#example.com"))

Fixed code:
from sydent.util.stringutils import is_valid_matrix_server_name
        if not is_valid_matrix_server_name(json_request["origin"]):
            raise InvalidServerName("X-Matrix header's origin parameter must be a valid Matrix server name")
from sydent.util.stringutils import is_valid_matrix_server_name
        if not is_valid_matrix_server_name(matrix_server):
                'error': 'matrix_server_name must be a valid Matrix server name (IP address or hostname)'
        if not is_valid_matrix_server_name(user_id_server):
from sydent.util.stringutils import is_valid_matrix_server_name
        if not is_valid_matrix_server_name(matrix_server):
                "MXID server part '%s' not a valid Matrix server name. Not retrying.",
            except Exception:
from typing import Optional, Tuple

from twisted.internet.abstract import isIPAddress, isIPv6Address
# hostname/domain name
    """Validate that a given string is a valid hostname or domain name.
    instance, it doesn't check that the TLD is valid).
    return hostname_regex.match(string) is not None


def parse_server_name(server_name: str) -> Tuple[str, Optional[int]]:
    """Split a server name into host/port parts.
    No validation is done on the host part. The port part is validated to be
    a valid port number.
    Args:
        server_name: server name to parse

    Returns:
        host/port parts.

    Raises:
        ValueError if the server name could not be parsed.
    """
    try:
        if server_name[-1] == "]":
            # ipv6 literal, hopefully
            return server_name, None

        host_port = server_name.rsplit(":", 1)
        host = host_port[0]
        port = host_port[1] if host_port[1:] else None

        if port:
            # exclude things like '08090' or ' 8090'
            if port != str(port_num) or not (1 <= port_num < 65536):
                raise ValueError("Invalid port")

        return host, port
    except Exception:
        raise ValueError("Invalid server name '%s'" % server_name)


def is_valid_matrix_server_name(string: str) -> bool:
    """Validate that the given string is a valid Matrix server name.

    A string is a valid Matrix server name if it is one of the following, plus
    an optional port:

    a. IPv4 address
    b. IPv6 literal (`[IPV6_ADDRESS]`)
    c. A valid hostname

    :param string: The string to validate
    :type string: str

    :return: Whether the input is a valid Matrix server name
    :rtype: bool
    """

    try:
        host, port = parse_server_name(string)
    except ValueError:
        return False

    valid_ipv4_addr = isIPAddress(host)
    valid_ipv6_literal = host[0] == "[" and host[-1] == "]" and isIPv6Address(host[1:-1])

    return valid_ipv4_addr or valid_ipv6_literal or is_valid_hostname(host)

from sydent.util.stringutils import is_valid_matrix_server_name

    def test_is_valid_matrix_server_name(self):
        """Tests that the is_valid_matrix_server_name function accepts only
        valid hostnames (or domain names), with optional port number.
        self.assertTrue(is_valid_matrix_server_name("9.9.9.9"))
        self.assertTrue(is_valid_matrix_server_name("9.9.9.9:4242"))
        self.assertTrue(is_valid_matrix_server_name("[::]"))
        self.assertTrue(is_valid_matrix_server_name("[::]:4242"))
        self.assertTrue(is_valid_matrix_server_name("[a:b:c::]:4242"))

        self.assertTrue(is_valid_matrix_server_name("example.com"))
        self.assertTrue(is_valid_matrix_server_name("EXAMPLE.COM"))
        self.assertTrue(is_valid_matrix_server_name("ExAmPlE.CoM"))
        self.assertTrue(is_valid_matrix_server_name("example.com:4242"))
        self.assertTrue(is_valid_matrix_server_name("localhost"))
        self.assertTrue(is_valid_matrix_server_name("localhost:9000"))
        self.assertTrue(is_valid_matrix_server_name("a.b.c.d:1234"))
        self.assertFalse(is_valid_matrix_server_name("[:::]"))
        self.assertFalse(is_valid_matrix_server_name("a:b:c::"))
        self.assertFalse(is_valid_matrix_server_name("example.com:65536"))
        self.assertFalse(is_valid_matrix_server_name("example.com:0"))
        self.assertFalse(is_valid_matrix_server_name("example.com:-1"))
        self.assertFalse(is_valid_matrix_server_name("example.com:a"))
        self.assertFalse(is_valid_matrix_server_name("example.com: "))
        self.assertFalse(is_valid_matrix_server_name("example.com:04242"))
        self.assertFalse(is_valid_matrix_server_name("example.com: 4242"))
        self.assertFalse(is_valid_matrix_server_name("example.com/example.com"))
        self.assertFalse(is_valid_matrix_server_name("example.com#example.com"))