Executive brief
Synapse is a Matrix homeserver that enables federated real-time messaging and collaboration. A weakness in how authentication chain indices are calculated allows a remote, malicious user sharing a room to send specially crafted events that consume excessive CPU resources and fill the server's database, causing the service to become unavailable. Affected servers must be in public federations; private or non-federated instances are not impacted.
Technical details
This vulnerability is a resource exhaustion flaw (CWE-770) in Synapse's V2 state resolution algorithm, specifically in the calculation of the auth chain cover index. A remote Matrix user can craft and dispatch malicious events to exploit this weakness, inducing high CPU consumption and accumulating excessive database entries. The attack requires the attacker to be a member of a shared room; servers in private federations or those that do not federate are unaffected. Patch versions 1.105.1 and later resolve the issue. Workarounds include banning the malicious user, applying ACL blocks, or leaving and purging the affected room via the admin API.
Affected products
- Element Synapse before 1.105.1
Timeline
- 2024-04-23: disclosed
- 2024-04-23: patched: Version 1.105.1 released