#VU49037 Resource exhaustion in Synapse - CVE-2020-26257
Vulnerability identifier: #VU49037
Vulnerability risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID:
CWE-ID:
CWE-400
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Synapse
Server applications /
Conferencing, Collaboration and VoIP solutions
Vendor: Matrix.org
Description
The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
Mitigation
Install update from vendor's website.
Vulnerable software versions
Synapse: 1.23.0
External links
https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09
https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8b
https://github.com/matrix-org/synapse/pull/8776
https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mm
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
