CVE-2021-29430
📋 TL;DR
CVE-2021-29430 is a denial-of-service vulnerability in Sydent, a Matrix identity server, where attackers can send oversized HTTP requests or receive oversized responses to exhaust server memory. This affects any Sydent server accepting registration requests from untrusted clients or communicating with untrusted Matrix homeservers.
💻 Affected Systems
- Sydent (Matrix identity server)
📦 What is this software?
Sydent by Matrix
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to memory exhaustion, rendering the identity server unavailable for legitimate users.
Likely Case
Intermittent service degradation or temporary unavailability as memory resources are consumed.
If Mitigated
Minimal impact with proper request/response size limits implemented at the application or proxy layer.
🎯 Exploit Status
Exploitation requires sending large HTTP payloads, which is trivial with standard tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.3.0
Vendor Advisory: https://github.com/matrix-org/sydent/security/advisories/GHSA-wmg4-8cp2-hpg9
Restart Required: Yes
Instructions:
1. Update Sydent to version 2.3.0 or later. 2. Apply commits 89071a1, 0523511, and f56eee3 if patching manually. 3. Restart the Sydent service.
🔧 Temporary Workarounds
Reverse Proxy Request Limiting
allConfigure HTTP reverse proxy (e.g., nginx, Apache) to limit request body size.
nginx: client_max_body_size 10M;
Apache: LimitRequestBody 10485760
🧯 If You Can't Patch
- Implement network-level controls to block unusually large HTTP requests.
- Monitor memory usage and restart services if abnormal consumption is detected.
🔍 How to Verify
Check if Vulnerable:
Check Sydent version; if below 2.3.0, it is vulnerable.Check Version:
Check Sydent logs or configuration for version information.Verify Fix Applied:
Confirm version is 2.3.0 or later and test with oversized requests to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Large HTTP request logs
- Memory exhaustion errors in system logs
Network Indicators:
- Unusually large HTTP requests to Sydent endpoints
SIEM Query:
source="sydent.log" AND (message="*large request*" OR message="*memory*" OR message="*denial*")🔗 References
- https://github.com/matrix-org/sydent/commit/0523511d2fb40f2738f8a8549868f44b96e5dab7
- https://github.com/matrix-org/sydent/commit/89071a1a754c69a50deac89e6bb74002d4cda19d
- https://github.com/matrix-org/sydent/commit/f56eee315b6c44fdd9f6aa785cc2ec744a594428
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0
- https://github.com/matrix-org/sydent/security/advisories/GHSA-wmg4-8cp2-hpg9
- https://pypi.org/project/matrix-sydent/
- https://github.com/matrix-org/sydent/commit/0523511d2fb40f2738f8a8549868f44b96e5dab7
- https://github.com/matrix-org/sydent/commit/89071a1a754c69a50deac89e6bb74002d4cda19d
- https://github.com/matrix-org/sydent/commit/f56eee315b6c44fdd9f6aa785cc2ec744a594428
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0
- https://github.com/matrix-org/sydent/security/advisories/GHSA-wmg4-8cp2-hpg9
- https://pypi.org/project/matrix-sydent/
