Executive brief
Matrix Synapse is a real-time communication server that hosts media files for a messaging platform. When the media repository is enabled, a vulnerability allows attackers to cause the server to download files from remote servers and save them to arbitrary directories on the system, potentially outside the intended media storage area. This could enable attackers to overwrite critical application files or gain system access.
Technical details
A path traversal vulnerability (CWE-22) exists in Matrix Synapse's media download functionality. The vulnerability allows unauthenticated remote attackers to manipulate the download path when fetching media from remote servers, causing files to be saved outside the intended media store directory. The attack requires the media repository to be enabled; instances with the repository disabled or with federation whitelisting are unaffected. Although the last two directory levels and filename are randomly generated by Synapse (limiting attacker control), the vulnerability still permits directory traversal. The fix was released in version 1.47.1 and later.
Affected products
- Matrix.org Synapse before 1.47.1
Timeline
- 2021-11-23: disclosed
- 2021-11-23: patched: version 1.47.1 released