CVE-2024-52805: Synapse allows unsupported content types to lead to memory exhaustion
Impact
In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.
Patches
Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Workarounds
Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low maxuploadsize in Synapse.
References
- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518 - https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52805?
CVE-2024-52805 has a moderate severity level due to its potential for amplifying denial of service attacks through increased memory consumption.
How do I fix CVE-2024-52805?
To fix CVE-2024-52805, upgrade to Synapse version 1.120.1 or later.
What types of requests are affected by CVE-2024-52805?
CVE-2024-52805 affects `multipart/form-data` requests in Synapse.
Is there a workaround for CVE-2024-52805 before upgrading?
There are no specific workarounds recommended for CVE-2024-52805, so upgrading as soon as possible is advised.
Which software version should I avoid due to CVE-2024-52805?
You should avoid versions of Synapse prior to 1.120.1 due to the vulnerability identified as CVE-2024-52805.