Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NMatrix Sydent
APPMatrix< 2.3.0
Related vulnerabilities
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to ...
Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP...
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is...
Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails...
Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of ...