Excessive Connection Vulnerability in Matrix Synapse URL Preview Functionality
Summary
CVE-2022-41952: Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Affects matrix-synapse across 2 version ranges.
< 1.53.0-1
< 551dd8c9f8d10681dc535ec43d652bbadf60de48
Fixed in 1.53.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source server for the Matrix protocol, enabling real-time communication. It supports various features, including URL previews, which allow users to see a preview of linked content. However, a vulnerability exists in versions prior to 1.53.0, where the URL preview functionality can lead to excessive connections to media streaming servers, potentially causing service disruptions.
Vulnerability Detail
The vulnerability arises from the URL preview functionality in Synapse versions before 1.53.0. When enabled, Synapse attempts to generate previews for media stream URLs without properly limiting the connection time. Connections remain active until a maximum data size is reached, which can lead to prolonged connections to streaming media servers, such as Icecast. This behavior can result in excessive traffic and strain on the server, especially in large rooms with multiple Synapse instances. The issue is addressed in version 1.53.0, which introduces a timeout mechanism to terminate connections after 30 seconds and an allow list for content types to prevent unnecessary preview attempts.
How To Fix
Minimum fixed version
1.53.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade matrix-synapseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the URL preview functionality by adding the following line to your Synapse configuration file:
url_preview_enabled: false
Conclusion
The vulnerability in Matrix Synapse's URL preview functionality poses a risk of excessive connections to media streaming servers, which can lead to service disruptions. Upgrading to version 1.53.0 or later is essential to mitigate this risk. Additionally, disabling URL previews can serve as a temporary workaround while a permanent fix is implemented.
See every vulnerability recorded for matrix-synapse →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Versions of Matrix Synapse prior to 1.53.0 are affected by this vulnerability.
If exploited, this vulnerability can lead to excessive traffic and connections to media streaming servers, potentially causing service disruptions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
