Is CVE-2024-37302 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-37302 being exploited in the wild.

How severe is CVE-2024-37302?

High severity, with a CVSS score of 7.5, published 3 December 2024.

Which products and versions are affected?

Element Synapse < 1.106; matrix-synapse (PyPI) < 1.106, ECOSYSTEM:introduced=0,fixed=1.106, ECOSYSTEM:introduced=0,fixed=1.106.0.

Is there a fix for CVE-2024-37302?

Yes. matrix-synapse (PyPI): upgrade to 1.106, 1.106.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-37302 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2024-37302?

Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-37302: Element Synapse denial of service via media disk space consumption

Q: Which products and versions are affected?

Element Synapse < 1.106; matrix-synapse (PyPI) < 1.106, ECOSYSTEM:introduced=0,fixed=1.106, ECOSYSTEM:introduced=0,fixed=1.106.0.

Q: Is there a fix for CVE-2024-37302?

Yes. matrix-synapse (PyPI): upgrade to 1.106, 1.106.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-37302 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2024-37302?

Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-37302 · Severity: high · CVSS 7.5 · Published 2024-12-03

Synapse, a popular server for the Matrix communication protocol, is vulnerable to an attack that can crash the service by filling up its storage space. An unauthenticated attacker can force the server to download and store massive amounts of media from remote sources, eventually exhausting disk space. This can lead to a total service outage, preventing users from sending messages or accessing the platform.

Technologies: Element Synapse, matrix-synapse (PyPI). Vendors: Element, PyPI.

Quick answers

Is CVE-2024-37302 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-37302 being exploited in the wild.
How severe is CVE-2024-37302?: High severity, with a CVSS score of 7.5, published 3 December 2024.
Which products and versions are affected?: Element Synapse < 1.106; matrix-synapse (PyPI) < 1.106, ECOSYSTEM:introduced=0,fixed=1.106, ECOSYSTEM:introduced=0,fixed=1.106.0.
Is there a fix for CVE-2024-37302?: Yes. matrix-synapse (PyPI): upgrade to 1.106, 1.106.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-37302 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-37302?: Check whether you run Element Synapse or matrix-synapse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

matrix-synapse (PyPI): upgrade to 1.106, 1.106.0 or later
```
pip install "matrix-synapse>=1.106.0"
```

Technical details

Synapse versions prior to 1.106 contain a resource exhaustion vulnerability (CWE-770) in the media caching component. An unauthenticated remote attacker can exploit insufficient rate limiting to induce the server to fetch and cache large volumes of remote media files. This results in a 'disk fill' attack that can lead to the failure of media operations or the complete unavailability of the Synapse process. The vulnerability is addressed in version 1.106 by implementing a 'leaky bucket' rate limit on remote media downloads. Temporary workarounds include reducing the maximum allowed file size or moving media storage to a dedicated isolated volume.

Affected products

Element Synapse < 1.106

Identifiers

CVE-2024-37302
GHSA-4mhg-xv73-xq2x
PYSEC-2024-286

Timeline

2024-12-03: advisory: GitHub Advisory published
2024-12-03: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.