Executive brief
Synapse is a server implementation of the Matrix communication protocol that can generate previews of URLs shared by users. When processing maliciously-crafted or unusual web pages, the URL preview feature can consume unbounded stack memory through recursive operations, potentially crashing the media repository or entire Synapse server. This affects only deployments with URL previews explicitly enabled in configuration.
Technical details
The vulnerability is a classic unbounded recursion issue (CWE-674) in Synapse's URL preview functionality. When parsing certain web pages, the preview handler does not properly limit recursion depth, allowing an attacker to craft a page that causes the Synapse process to exhaust available stack space. The URL preview endpoint requires authentication, so only authenticated users on the homeserver or users whose clients automatically request previews can exploit this. The attack is sometimes recoverable (returning an error), but can also cause the entire Synapse process to crash. The vulnerability was patched in version 1.61.1.
Affected products
- Matrix Synapse before 1.61.1
Timeline
- 2022-06-29: disclosed
- 2022-06-29: patched: Version 1.61.1 released