CVE-2024-37302: Synapse denial of service through media disk space consumption
Impact
Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed.
Patches
Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
Workarounds
Synapse deployments can currently decrease the maximum file size allowed, as well as increase request rate limits. However, this does not as effectively address the issue as a dedicated rate limit on remote media downloads.
Server operators may also wish to consider putting media on a dedicated disk or volume, reducing the impact of a disk fill condition.
References
https://en.wikipedia.org/wiki/Leakybucket#Asameter
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/matrix-synapseto a version that resolves this vulnerability.Fixed in 1.106 - Upgrade
Upgrade
alpine/synapseto a version that resolves this vulnerability.Fixed in 1.110.0-r0 - Upgrade
Upgrade
Synapseto a version that resolves this vulnerability.Fixed in 1.106 - Configuration
Decrease the maximum file size allowed for media downloads.
Synapse maximum file size allowed = decreased - Configuration
Increase request rate limits to limit the amount of remote media an unauthenticated user can request to be cached.
Synapse request rate limits = increased - Compensating control
Put media on a dedicated disk or volume to reduce the impact of a disk-fill condition.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37302?
CVE-2024-37302 is considered a medium severity vulnerability due to its potential for causing denial of service through disk fill attacks.
How do I fix CVE-2024-37302?
To fix CVE-2024-37302, upgrade to Synapse version 1.106 or later.
What does CVE-2024-37302 affect?
CVE-2024-37302 affects Synapse versions prior to 1.106.
Who can exploit CVE-2024-37302?
An unauthenticated adversary can exploit CVE-2024-37302 to induce a disk fill attack.
What is a disk fill attack in the context of CVE-2024-37302?
A disk fill attack in the context of CVE-2024-37302 occurs when large amounts of remote media are downloaded and cached, leading to potential denial of service.