Denial of Service Vulnerability in Matrix Synapse Prior to Version 1.94.0
Summary
CVE-2023-45129: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Affects matrix-synapse across 2 version ranges.
< 1.94.0-1
< 25c412b3c57962104d7a9452f03a0fca7e999bc2
Fixed in 1.94.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source Matrix homeserver developed by the Matrix.org Foundation, enabling real-time communication and collaboration through the Matrix protocol. It supports a wide range of features, including secure messaging, voice and video calls, and integration with various applications. The server is designed to be scalable and flexible, catering to both small and large deployments. However, it is susceptible to a specific vulnerability that can lead to performance degradation or denial of service under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2023-45129, arises from a malicious server ACL (Access Control List) event that can temporarily or permanently impact the performance of the Synapse homeserver. This can lead to a persistent denial of service, affecting the availability of the server for its users. Homeservers operating within a closed federation, which typically do not utilize server ACLs, are not impacted by this vulnerability. The technical aspect involves the handling of server ACL events, which, if manipulated, can overwhelm the server's resources.
How To Fix
Minimum fixed version
1.94.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade matrix-synapseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can purge and block rooms that contain malicious server ACL events using the admin API. This can be done with the following API call: POST /_synapse/admin/v1/purge_room/{roomId}, where {roomId} is the ID of the room to be purged.
Conclusion
CVE-2023-45129 represents a significant vulnerability in Matrix Synapse that can lead to denial of service if not addressed. It is crucial for server administrators to upgrade to version 1.94.0 or later to mitigate this risk. Additionally, utilizing workarounds and monitoring tools like Vulert can help maintain the security and performance of the server.
See every vulnerability recorded for matrix-synapse →
FAQ
CVE-2023-45129 is a vulnerability in Matrix Synapse that can lead to denial of service due to malicious server ACL events.
If you are running a version prior to 1.94.0, your server may be vulnerable. You can check your version using the command: matrix-synapse --version.
Server ACL events are access control lists that define permissions for users and servers within the Matrix protocol, impacting how rooms and communication are managed.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json.
The CVSS score for CVE-2023-45129 is 4.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
