Skip to content
Fencer Vulns
high 7.7

CVE-2021-29431 json

SSRF in Sydent due to missing validation of hostnames

published 2021-04-15 5 y ago modified 2026-09-10 1 mo ago also GHSA-9jhm-8m8c-c3f4 , PYSEC-2021-22 , EUVD-2021-0120

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

Patch / fix

  • pypi matrix-sydent 2.3.0
  • matrix sydent 2.3.0

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi matrix-sydent
<2.3.0
2.3.0

Affected products

  • matrix-org sydent

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.