CVE-2021-41281: 
Python vulnerability analysis and mitigation

CVE-2021-41281 affects Synapse, a Matrix homeserver implementation written in Python 3/Twisted. The vulnerability was discovered and disclosed in November 2021, affecting all versions prior to 1.47.1. The vulnerability allows instances with enabled media repository to be tricked into downloading files from remote servers into arbitrary directories (Matrix Advisory).

The vulnerability is classified as a path traversal issue (CWE-22) that allows unauthorized access to write files outside the intended media store directory. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No authentication is required for the affected endpoint, though the last two directories and file name of the path are randomly chosen by Synapse and cannot be controlled by an attacker (Matrix Advisory).

The vulnerability allows attackers to write files to arbitrary directories on systems running vulnerable Synapse versions with media repository enabled. However, the impact is somewhat limited as attackers cannot control the final parts of the path. Homeservers with the media repository disabled or those using a federation whitelist are unaffected (Matrix Advisory).

The primary mitigation is to upgrade to Synapse version 1.47.1 or later. For administrators unable to upgrade immediately, alternative workarounds include blocking specific media endpoints via reverse proxy (at the cost of losing media functionality) or using the hardened systemd configuration for non-containerized deployments. The specific endpoints to block are /_matrix/media/r0/download/{serverName}/{mediaId}, /_matrix/media/r0/download/{serverName}/{mediaId}/{fileName}, and /_matrix/media/r0/thumbnail/{serverName}/{mediaId} (Matrix Advisory).

The vulnerability was addressed promptly with the release of version 1.47.1, and distribution maintainers quickly incorporated the fix. For example, Fedora released security updates for both Fedora 34 and 35 to address this vulnerability (Fedora Update).