CVE-2024-52815: Synapse allows a a malformed invite to break the invitee's `/sync`
Impact
Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality.
Patches
Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
Workarounds
Server administrators can disable federation from untrusted servers.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Other sources
Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52815?
CVE-2024-52815 is considered a moderate severity vulnerability due to its impact on user functionality during federation invites.
How do I fix CVE-2024-52815?
To fix CVE-2024-52815, upgrade to Synapse version 1.120.1 or later.
What type of functionality is disrupted by CVE-2024-52815?
CVE-2024-52815 disrupts the '/sync' functionality for users receiving specially crafted invites.
Which versions of Synapse are affected by CVE-2024-52815?
Synapse versions prior to 1.120.1 are affected by CVE-2024-52815.
Can a malicious server exploit CVE-2024-52815?
Yes, a malicious server can exploit CVE-2024-52815 by sending crafted invites that disrupt users' functionality.