CVE-2024-31208: PYSEC-2024-50 - Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.

CVE-2024-31208 · Severity: low · CVSS 3.1 · Published 2024-04-23

Synapse is a Matrix homeserver that enables federated real-time messaging and collaboration. A weakness in how authentication chain indices are calculated allows a remote, malicious user sharing a room to send specially crafted events that consume excessive CPU resources and fill the server's database, causing the service to become unavailable. Affected servers must be in public federations; private or non-federated instances are not impacted.

Technologies: Element Synapse, matrix-synapse (PyPI). Vendors: Element, PyPI.

Quick answers

Is CVE-2024-31208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-31208 being exploited in the wild.
How severe is CVE-2024-31208?
Low severity, with a CVSS score of 3.1, published 23 April 2024.
Which products and versions are affected?
Element Synapse before 1.105.1; matrix-synapse (PyPI) GIT:introduced=0,fixed=55b0aa847a61774b6a3acdc4b177a20dc019f01a|ECOSYSTEM:introduced=0,fixed=1.105.1.
Is there a fix for CVE-2024-31208?
Yes. matrix-synapse (PyPI): upgrade to 1.105.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-31208 attacked?
It is attacked over the network.
Am I affected by CVE-2024-31208?
Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • matrix-synapse (PyPI): upgrade to 1.105.1 or later
    pip install "matrix-synapse>=1.105.1"

Technical details

This vulnerability is a resource exhaustion flaw (CWE-770) in Synapse's V2 state resolution algorithm, specifically in the calculation of the auth chain cover index. A remote Matrix user can craft and dispatch malicious events to exploit this weakness, inducing high CPU consumption and accumulating excessive database entries. The attack requires the attacker to be a member of a shared room; servers in private federations or those that do not federate are unaffected. Patch versions 1.105.1 and later resolve the issue. Workarounds include banning the malicious user, applying ACL blocks, or leaving and purging the affected room via the admin API.

Affected products

  • Element Synapse before 1.105.1

Identifiers

  • CVE-2024-31208
  • GHSA-3h7q-rfh9-xm4v
  • PYSEC-2024-50

Timeline

  • 2024-04-23: disclosed
  • 2024-04-23: patched: Version 1.105.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.