CVE-2024-37302: Synapse denial of service through media disk space consumption
Impact
Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed.
Patches
Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
Workarounds
Synapse deployments can currently decrease the maximum file size allowed, as well as increase request rate limits. However, this does not as effectively address the issue as a dedicated rate limit on remote media downloads.
Server operators may also wish to consider putting media on a dedicated disk or volume, reducing the impact of a disk fill condition.
References
https://en.wikipedia.org/wiki/Leakybucket#Asameter
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37302?
CVE-2024-37302 is considered a medium severity vulnerability due to its potential for causing denial of service through disk fill attacks.
How do I fix CVE-2024-37302?
To fix CVE-2024-37302, upgrade to Synapse version 1.106 or later.
What does CVE-2024-37302 affect?
CVE-2024-37302 affects Synapse versions prior to 1.106.
Who can exploit CVE-2024-37302?
An unauthenticated adversary can exploit CVE-2024-37302 to induce a disk fill attack.
What is a disk fill attack in the context of CVE-2024-37302?
A disk fill attack in the context of CVE-2024-37302 occurs when large amounts of remote media are downloaded and cached, leading to potential denial of service.