Executive brief
Dendrite, a communication server for the Matrix protocol, contains a security flaw in its media download system. An unauthenticated attacker can trick the server into making unauthorized connections to other computers on the internal network. This allows the attacker to map out private infrastructure and identify active internal services that should not be visible from the internet.
Technical details
A server-side request forgery (SSRF) vulnerability exists in Dendrite through version 0.13.8 within the legacy media download endpoint (_matrix/media/r0/download). The vulnerability is caused by insufficient validation of the 'serverName' parameter, which allows an unauthenticated remote attacker to force the server to initiate outbound TLS connections to arbitrary hosts and ports. By analyzing distinguishable error responses and leaked internal IP addresses in error messages, an attacker can perform blind port scanning and enumerate internal network topology. The product repository was archived in late 2024, and users should verify if patches are available or migrate to supported Matrix homeserver implementations.
Affected products
- Matrix.org Dendrite <= 0.13.8
Timeline
- 2024-11-25: other: Project repository archived by owner
- 2026-07-17: disclosed: Vulnerability disclosed and CVE assigned