CVE-2023-32323: Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Impact
A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y.
Synapse instances with federation disabled are not affected.
Details
The Matrix protocol allows homeservers to provide an inviteroomstate field on a room invite containing a summary of room state. In versions of Synapse up to and including v1.73.0, Synapse did not limit the size of inviteroomstate, meaning that it was possible to create an arbitrarily large invite event.
An attacker with an account on a vulnerable Synapse homeserver X could exploit this by having X create an over-sized invite event in a room with a user from another homeserver Y. Once acknowledged by the invitee's homeserver, the invite event would be sent in a batch of events to Y. If the malicious invite is so large that the entire batch is rejected as too large, X's outgoing traffic to Y would become "stuck", meaning that messages and state events created by X would remain unseen by Y.
Patches
Synapse 1.74 refuses to create oversized inviteroomstate fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
Workarounds
There are no robust workarounds.
This attack needs an account on Synapse homeserver X to deny federation from X to another homeserver Y. As a partial mitigation, Synapse operators can disable open registration to limit the ability of attackers to create new accounts on homeserver X.
If homeserver X has been attacked in this way, restarting it will resume outgoing federation by entering "catchup mode". For catchup mode to ignore the oversized invites, every attacked room must have a correctly-sized event sent by X which is newer than any oversized invite. This is difficult to arrange, and does not prevent the attacker from repeating their attack.
References
- https://github.com/matrix-org/synapse/issues/14492 was caused by this issue. - https://github.com/matrix-org/synapse/issues/14642 includes the patch described above.
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Other sources
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of inviteroomstate, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized inviteroomstate fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-32323?
CVE-2023-32323 is a vulnerability in Synapse, an open-source Matrix homeserver, that allows a malicious user to disable outbound federation from one homeserver to another.
How does CVE-2023-32323 affect Synapse instances?
Synapse instances with federation disabled are not affected by CVE-2023-32323.
What is the impact of CVE-2023-32323?
The impact of CVE-2023-32323 is that it can disable outbound federation from one Synapse homeserver to another.
How can I fix CVE-2023-32323?
To fix CVE-2023-32323, upgrade Synapse to version 1.74.0 or higher.
Are there any references or resources related to CVE-2023-32323?
Yes, you can find more information about CVE-2023-32323 in the following links: [GitHub Advisory](https://github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvr), [GitHub Issue](https://github.com/matrix-org/synapse/issues/14492), [GitHub Pull Request](https://github.com/matrix-org/synapse/pull/14642).