Dendrite vulnerabilities

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint. It allows authenticated local users to access post-leave room state events by exploiting a flawed membership check.

Dendrite up to version 0.13.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.

Dendrite through version 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.