Executive brief
Synapse, a popular server for the Matrix communication protocol, is vulnerable to an attack that can crash the service by filling up its storage space. An unauthenticated attacker can force the server to download and store massive amounts of media from remote sources, eventually exhausting disk space. This can lead to a total service outage, preventing users from sending messages or accessing the platform.
Technical details
Synapse versions prior to 1.106 contain a resource exhaustion vulnerability (CWE-770) in the media caching component. An unauthenticated remote attacker can exploit insufficient rate limiting to induce the server to fetch and cache large volumes of remote media files. This results in a 'disk fill' attack that can lead to the failure of media operations or the complete unavailability of the Synapse process. The vulnerability is addressed in version 1.106 by implementing a 'leaky bucket' rate limit on remote media downloads. Temporary workarounds include reducing the maximum allowed file size or moving media storage to a dedicated isolated volume.
Affected products
- Element Synapse < 1.106
Timeline
- 2024-12-03: advisory: GitHub Advisory published
- 2024-12-03: disclosed: NVD publication date