Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill
    attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of
    remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial
    of service, ranging from further media uploads/downloads failing to completely unavailability of the
    Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate
    limit on remote media downloads to reduce the amount of data a user can request at a time. This does not
    fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data
    to be cached. (CVE-2024-37302)

  - Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design,
    unauthenticated remote participants to trigger a download and caching of remote media from a remote
    homeserver to the local media repository. Such content then also becomes available for download from the
    local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can
    use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a
    partial mitigation in the form of new endpoints which require authentication for media downloads. The
    unauthenticated endpoints will be frozen in a future release, closing the attack vector. (CVE-2024-37303)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill     attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of     remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial     of service, ranging from further media uploads/downloads failing to completely unavailability of the     Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new leaky bucket rate     limit on remote media downloads to reduce the amount of data a user can request at a time. This does not     fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data     to be cached. (CVE-2024-37302)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill
    attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of
    remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial
    of service, ranging from further media uploads/downloads failing to completely unavailability of the
    Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate
    limit on remote media downloads to reduce the amount of data a user can request at a time. This does not
    fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data
    to be cached. (CVE-2024-37302)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 71f3e9f0-bafc-11ef-885d-901b0e934d69 advisory.

    element-hq/synapse developers report:
    [The 1.120.1] release fixes multiple security                     vulnerabilities, some affecting all prior versions of                     Synapse. Server administrators are encouraged to                     update Synapse as soon as possible. We are not aware                     of these vulnerabilities being exploited in the                     wild.
    Administrators who are unable to update Synapse may                     use the workarounds described in the linked GitHub                     Security Advisory below.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426248	Alpine: multiple synapse packages: security update to 1.110.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426248	Alpine: multiple synapse packages: security update to 1.110.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
234206	Linux Distros Unpatched Vulnerability : CVE-2024-37302	Nessus	Misc.	high
410286	SCA: security update for matrix-synapse (GHSA-4mhg-xv73-xq2x)	Tenable Cloud Security	SCA Checks	high
410286	SCA: security update for matrix-synapse (GHSA-4mhg-xv73-xq2x)	Tenable Self-Hosted Container Security	SCA Checks	high
213068	FreeBSD : py-matrix-synapse -- multiple vulnerabilities in versions prior to 1.120.1 (71f3e9f0-bafc-11ef-885d-901b0e934d69)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-37302

high

Tenable Plugins

high

high

high

high

high

high