CVE-2021-41100
📋 TL;DR
This vulnerability in Wire-server allows attackers to change user email addresses using only short-lived session tokens, leading to potential account takeover. It affects on-premise Wire-server instances where users are not exclusively provisioned via SCIM. SAML SSO users are unaffected.
💻 Affected Systems
- Wire-server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover where attacker changes email to their own address, resets password, and gains full control of the account.
Likely Case
Account compromise leading to unauthorized access to sensitive communications and data.
If Mitigated
No impact if using SCIM provisioning exclusively or if proper patching/workarounds are implemented.
🎯 Exploit Status
Requires obtaining a short-lived token, which is transmitted in HTTP headers and used frequently, increasing exposure risk.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021-08-16 and later
Vendor Advisory: https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m
Restart Required: Yes
Instructions:
1. Update Wire-server to version 2021-08-16 or later. 2. Restart the Wire-server service. 3. Verify the new endpoint requiring both long-lived cookie and Authorization header is in place.
🔧 Temporary Workarounds
Block vulnerable endpoint
allBlock access to the /self/email endpoint at the proxy/firewall level
# In nginx configuration: location /self/email { deny all; }
🧯 If You Can't Patch
- Implement network-level blocking of /self/email endpoint
- Migrate all users to SCIM provisioning if possible
🔍 How to Verify
Check if Vulnerable:
Check if Wire-server version is older than 2021-08-16 and if /self/email endpoint accepts PUT requests with only Authorization headerCheck Version:
Check Wire-server deployment version in configuration or via API endpointVerify Fix Applied:
Verify Wire-server version is 2021-08-16 or newer and that /self/email endpoint now requires both cookie and Authorization header📡 Detection & Monitoring
Log Indicators:
- Multiple failed email change attempts
- Email change requests using only Authorization header without cookie
Network Indicators:
- PUT requests to /self/email endpoint without corresponding cookie authentication
SIEM Query:
source="wire-server" AND (uri_path="/self/email" AND http_method="PUT") AND NOT (cookie="*" AND authorization="*")