CVE-2024-52805: Synapse allows unsupported content types to lead to memory exhaustion
Impact
In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.
Patches
Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Workarounds
Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low maxuploadsize in Synapse.
References
- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518 - https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/matrix-synapseto a version that resolves this vulnerability.Fixed in 1.120.1 - Upgrade
Upgrade
alpine/synapseto a version that resolves this vulnerability.Fixed in 1.120.1 - Upgrade
Upgrade
alpine/synapseto a version that resolves this vulnerability.Fixed in 1.120.2-r0 - Upgrade
Upgrade
Synapseto a version that resolves this vulnerability.Fixed in 1.120.1 - Configuration
Use a low max_upload_size in Synapse to mitigate the attack.
Synapse max_upload_size = low - Compensating control
Before requests reach Synapse, limit request sizes or block the multipart/form-data content type, for example in a reverse proxy.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52805?
CVE-2024-52805 has a moderate severity level due to its potential for amplifying denial of service attacks through increased memory consumption.
How do I fix CVE-2024-52805?
To fix CVE-2024-52805, upgrade to Synapse version 1.120.1 or later.
What types of requests are affected by CVE-2024-52805?
CVE-2024-52805 affects `multipart/form-data` requests in Synapse.
Is there a workaround for CVE-2024-52805 before upgrading?
There are no specific workarounds recommended for CVE-2024-52805, so upgrading as soon as possible is advised.
Which software version should I avoid due to CVE-2024-52805?
You should avoid versions of Synapse prior to 1.120.1 due to the vulnerability identified as CVE-2024-52805.