matrix-synapse@1.11.0 vulnerabilities

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a weakness in how the auth chain cover index is calculated. An attacker can induce high CPU consumption and accumulate excessive data in the database by dispatching specially crafted events.

Upgrade matrix-synapse to version 1.105.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Information Exposure. An attacker can query remote users' device information which can be used to enumerate the remote users known to a homeserver.

Upgrade matrix-synapse to version 1.95.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ACL event. An attacker can cause a denial of service by sending a malicious ACL event.

Upgrade matrix-synapse to version 1.94.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Improper Input Validation due to the improper validation of receipts. An attacker can forge read receipts for any event by knowing the room ID and event ID.

Upgrade matrix-synapse to version 1.93.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Incorrect Authorization in that it does not check for deactivated status of users during login, under certain conditions. Specifically, JSON Web Tokens must be enabled via the jwt_config.enabled setting, the local password database must be enabled via the password_config.enabled and password_config.localdb_enabled settings, and a user's password must be updated via an admin API after a user is deactivated.

NOTE: Installations configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.

If not using JSON Web Tokens, the list of deactivated users with a password set can be queried from PostgreSQL:

SELECT name FROM users WHERE password_hash IS NOT NULL AND deactivated = 1;

Upgrade matrix-synapse to version 1.85.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) by bypassing the url_preview_url_blacklist deny list with oEmbed or image URLs used in previews. An attacker can bypass the deny list by including an IP address that is allowed by the url_preview_ip_range_blacklist setting (only public addresses by default). The information exposed by the client is limited by the following conditions:

• For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded.

• For discovered image URLs, any non-image response is discarded.

Upgrade matrix-synapse to version 1.85.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS) to specific hosts by sending malicious invites. A malicious homeserver can disable its outbound federation to a different homeserver by sending a very large invite_room_state value in a room invite.

NOTE: Synapse instances with federation disabled are not affected.

Upgrade matrix-synapse to version 1.74.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Access Restriction Bypass due to Synapse homeservers answering a query for authorisation events not sufficiently checking that the requesting server should be able to access them. Authorisation events include power level events (the list of user IDs and their power levels at the time) and relevant membership events (including the display name of the sender of that event), as well as events like m.room.create, m.room.third_party_invite and m.room.join_rules. Non-authorisation events are unaffected, so it isn't possible to extract message contents this way.

NOTE: This issue is only exploitable when an attacker knows the ID of a target room and the ID of an event from that room, which increases the complexity of a realistic attack. Additionally, this issue is of negligible consequence for public rooms given that any server can easily join the roomand view authorisation events. Deployments in a closed federation where all homeservers are trustworthy are not affected.

Upgrade matrix-synapse to version 1.69.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling such that connections will only be terminated after max_spider_size (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast).

Upgrade matrix-synapse to version 1.53.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to incorrect application of event authorization rules.

Upgrade matrix-synapse to version 1.62.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the web page preview feature, due to unbounded recursion that can lead to exhaustion of the available stack space for the Synapse process. A malicious user on the home server, or remote users sending URLs that a local user's client can automatically request a URL preview for.

Note:

1. deployments with url_preview_enabled: false (default value is false) set in are not affected.

2. deployments with url_preview_enabled: true set in are affected.

Upgrade matrix-synapse to version 1.61.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Directory Traversal. Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.

Note

Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.

Upgrade matrix-synapse to version 1.47.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Information Exposure. Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where:

• the vulnerable homeserver is in the room; and
• untrusted users are permitted to create groups (communities).

By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting enable_group_creation has been set to true are impacted.

Upgrade matrix-synapse to version 1.41.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Information Exposure. Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.

Upgrade matrix-synapse to version 1.41.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). Lack of input validation of some parameters on the endpoints used to confirm third-party identifiers could lead to denial of service due to excessive use of disk space and memory.

Upgrade matrix-synapse to version 1.33.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). "Push rules" can specify conditions under which they will match, including event_match, which matches event content against a pattern including wildcards.

Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events.

Upgrade matrix-synapse to version 1.33.2 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). It is missing input validation of some parameters on the endpoints used to confirm third-party identifiers. This can cause excessive use of disk space and memory leading to resource exhaustion.

Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them.

Upgrade matrix-synapse to version 1.28.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Open Redirect. Requests to user provided domains are not restricted to external IP addresses when transitional IPv6 addresses are used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This can cause Synapse to make requests to internal infrastructure on dual-stack networks.

Upgrade matrix-synapse to version 1.28.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them.

Upgrade matrix-synapse to version 1.28.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the password reset endpoint. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

Upgrade matrix-synapse to version 1.27.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Improper Input Validation. HTML injection is possible in notification emails regarding missed messages or expiring account. In the case of notifications for missed messages, an attacker can inject forged content into the email. However, the account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.

Upgrade matrix-synapse to version 1.27.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Insecure Defaults. Requests to user provided domains are not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.

Upgrade matrix-synapse to version 1.25.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers.

Upgrade matrix-synapse to version 1.25.0rc1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a /send_join, /send_leave, /invite or /exchange_third_party_invite request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers.

Upgrade matrix-synapse to version 1.23.1 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Denial of Service (DoS). It permits non-standard NaN, Infinity, and Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.

Upgrade matrix-synapse to version 1.20.0 or higher.

matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Depending on the configuration of the domain that Synapse is deployed on it may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

Upgrade matrix-synapse to version 1.21.0 or higher.