CVE-2021-21404: 
Syncthing vulnerability analysis and mitigation

Syncthing, a continuous file synchronization program, was found to contain a vulnerability (CVE-2021-21404) affecting versions before 1.15.0. The vulnerability was discovered and disclosed in April 2021, affecting both the main Syncthing application and its relay server component (strelaysrv) (GitHub Advisory).

The vulnerability stems from improper handling of relay protocol messages. Specifically, when processing relay messages with a negative length field, both the main Syncthing application and the relay server could be caused to crash and exit. This vulnerability was addressed by implementing proper length field validation in the protocol handling code (GitHub Release).

The vulnerability could cause both Syncthing and the relay server (strelaysrv) to crash and exit when receiving malformed relay protocol messages. However, no sensitive data was exposed or liable to be altered due to this issue. Sensitive data was never exposed to relay operators (GitHub Advisory).

For exploitation, Syncthing would need to be lured to connect to a malicious relay server. The vulnerability could be triggered by sending a relay message with a negative length field. The issue was particularly relevant in environments where Syncthing communicated with unknown relays (GitHub Advisory).

The vulnerability was fixed in Syncthing version 1.15.0. For users unable to upgrade, Syncthing could be configured to not use relays or to only use specific, trusted relays. In closed environments or with relaying disabled, where Syncthing did not communicate with unknown relays, the system was not vulnerable. No known workaround was available for strelaysrv (GitHub Advisory).