Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers.
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
Impact
Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality.
Patches
Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
Workarounds
Server administrators can disable federation from untrusted servers.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Impact
In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing.
This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem.
For a list of image formats, as well as decoding libraries and helper programs used, see the Pillow documentation.
Patches
Synapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP.
Workarounds
- Ensure any image codecs and helper programs, such as Ghostscript, are patched against security vulnerabilities. - Uninstall unused image decoder libraries and helper programs, such as Ghostscript, from the system environment that Synapse is running in. - Depending on the installation method, there may be some decoder libraries bundled with Pillow and these cannot be easily uninstalled. - The official Docker container image does not include Ghostscript.
References
- The Pillow documentation includes a list of supported image formats and which libraries or helper programs are used to decode them.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Impact
In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.
Patches
Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
Workarounds
Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low maxuploadsize in Synapse.
References
- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518 - https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.
Patches This is fixed in #9200.
Workarounds Depending on the needs and configuration of the homeserver a few options are available:
1. Password resets can be disabled by delegating email to a third-party service (via the accountthreepiddelegates.email setting) or disabling email (by not configuring the email setting).
2. If the homeserver is not configured to use passwords (via the passwordconfig.enabled setting) then the affected endpoint can be blocked at a reverse proxy:
/synapse/client/passwordreset/email/submittoken
3. The passwordresetconfirmation.html template can be overridden with a custom template that manually escapes the variables using JInja2's escape filter. See the email.templatedir setting.
Impact
Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed.
Patches
Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
Workarounds
Synapse deployments can currently decrease the maximum file size allowed, as well as increase request rate limits. However, this does not as effectively address the issue as a dedicated rate limit on remote media downloads.
Server operators may also wish to consider putting media on a dedicated disk or volume, reducing the impact of a disk fill condition.
References
https://en.wikipedia.org/wiki/Leakybucket#Asameter
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Impact A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild.
Patches Fixed in Synapse v1.127.1.
Workarounds Closed federation environments of trusted servers or non-federating installations are not affected.
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Impact A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state.
Patches At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks.
Workarounds There are no known workarounds.
Upgrading notes If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.
Impact
Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.
The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.
Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.
Patches Server administrators should upgrade to 1.47.1 or later.
Workarounds Server administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints:
/matrix/media/r0/download/{serverName}/{mediaId} /matrix/media/r0/download/{serverName}/{mediaId}/{fileName} /matrix/media/r0/thumbnail/{serverName}/{mediaId}
Alternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at contrib/systemd/override-hardened.conf.
References n/a
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
Matrix Synapse before 0.34.0.1, when the macaroonsecretkey authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.powerlevels event in force.
The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly.
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018.
Impact
The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room.
In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers.
Patches
Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher.
Workarounds
Federation can be disabled by setting federationdomainwhitelist to an empty list ([]).
References
https://github.com/matrix-org/synapse/pull/13087 https://github.com/matrix-org/synapse/pull/13088
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Impact
A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in how the auth chain cover index is calculated. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service.
Servers in private federations, or those that do not federate, are not affected.
Patches
Server administrators should upgrade to 1.105.1 or later.
Workarounds
One can: - ban the malicious users or ACL block servers from the rooms; and/or - leave the room and purge the room using the admin API
For more information
If you have any questions or comments about this advisory, please email us at security AT element.io.
Impact If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected.
Synapse homeservers are affected by this issue if and only if they are joined to rooms which members of untrusted homeservers are joined or invited to.
- Synapse homeservers in rooms available over public federation are affected. - Synapse homeservers with federation disabled are not affected. - Synapse homeservers in a closed federation containing only trusted servers are not affected. - Synapse homeservers which are only joined to rooms with federation disabled[^1] are not affected.
Patches Administrators of homeservers with federation enabled are advised to upgrade to 1.68.0 or higher.
Workarounds Federation can be disabled by setting federationdomainwhitelist to an empty list ([]). from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0
References - https://github.com/matrix-org/synapse/pull/13723
[^1]: See m.federate in the m.room.create definition.
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Impact
A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a /sendjoin, /sendleave, /invite or /exchangethirdpartyinvite request.
This can lead to a denial of service in which future events will not be correctly sent to other servers over federation.
This affects any server which accepts federation requests from untrusted servers.
Patches
Issue is resolved by https://github.com/matrix-org/synapse/pull/8776.
Workarounds
Homeserver administrators could limit access to the federation API to trusted servers (for example via federationdomainwhitelist).
Impact Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.
Patches This issue is fixed by #9321 and #9393.
Workarounds The groups feature can be disabled (by setting enablegroupcreation to False) to mitigate this issue. Note that it is disabled by default.
Other information Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them.
Impact Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.
Patches The issue is fixed by #9321.
Workarounds Depending on the needs and configuration of the homeserver a few options are available:
1. Using email as third-party identifiers be disabled by not configuring the email setting. 2. Using phone numbers as third-party identifiers can be disabled by ensuring that accountthreepiddelegates.msisdn is not configured. 3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy:
^/matrix/client/(r0|unstable)/register/email ^/matrix/client/(r0|unstable)/register/msisdn ^/matrix/client/(r0|unstable)/account/password ^/matrix/client/(r0|unstable)/account/3pid
Impact A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver.
This affects any server which accepts federation requests from untrusted servers.
Patches Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108.
Workarounds The federationdomainwhitelist setting can be used to restrict the homeservers communicated with over federation.
Impact
URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether.
It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated.
Am I affected?
deployments with urlpreviewenabled: false set in configuration are not affected. deployments with urlpreviewenabled: true set in configuration are affected. deployments with no configuration value set for urlpreviewenabled are not affected, because the default is false.
Patches
Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher.
Workarounds
URL previews can be disabled in the configuration file by setting urlpreviewenabled: false. Deployments using workers can choose to offload URL previews to one or more dedicated worker(s), ensuring that a process crash does not disrupt other functionality of Synapse.
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting urlpreviewenabled: false in the Synapse configuration file.
Impact Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.
Patches This issue is fixed by #9240.
Workarounds Outbound requests to the following address ranges can be blocked by a firewall, if unused for internal communication between systems:
::ffff/80 ::0000/80 (note that this IP range is considered deprecated by the IETF) 2002::/16 (note that this IP range is considered deprecated by the IETF)
References RFC3056 RFC4291
Impact The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.
Patches This is fixed by #8444, which is included in Synapse v1.21.0.
Workarounds If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy:
/matrix/client/r0/auth/./fallback/web /matrix/client/unstable/auth/./fallback/web
Impact The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.
The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.
Patches This issue is fixed in #9200.
Workarounds For the missed messages notifications:
The notif.html, notifmail.html, and room.html templates can be overridden with custom templates that manually escapes the variables using JInja2's escape filter. See the email.templatedir setting.
For the account expiry notifications:
1. Account expiry can be disabled via the accountvalidity.enabled setting.
2. The noticeexpiry.html template can be overridden with a custom template that manually escapes the variables using JInja2's escape filter. See the email.templatedir setting.
Impact Requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.
For the most thorough protection server administrators should remove the deprecated federationiprangeblacklist from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new iprangeblacklist and iprangewhitelist settings if more specific control is necessary.
Patches Issue is resolved by #8821. Further improvements to protect homeservers by default were made in #8870 and #8954.
Workarounds Requests to internal IP addresses could be blocked at the system or network level.
Impact A discovered oEmbed or image URL can bypass the urlpreviewurlblacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the urlpreviewiprangeblacklist setting (by default this only allows public IPs) and by the limited information returned to the client:
For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. For discovered image URLs, any non-image response is discarded.
Systems which have URL preview disabled (via the urlpreviewenabled setting) or have not configured a urlpreviewurlblacklist are not affected.
Because of the uncommon configuration required, the limited information a malicious user, and the amount of guesses/time the attack would need; the severity is rated as low.
Patches
The issue is fixed by #15601.
Workarounds
The default configuration of the urlpreviewiprangeblacklist should protect against requests being made to internal infrastructure, URL previews of public URLs is expected.
Alternately URL previews could be disabled using the urlpreviewenabled setting.
Impact It may be possible for a deactivated user to login when using uncommon configurations.
This only applies if any of the following are true:
JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the passwordconfig.enabled and passwordconfig.localdbenabled configuration settings and a user's password is updated via an admin API after a user is deactivated.
Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated.
Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.
Patches
If using JSON Web Token logins: #15624 For other users: #15634
Workarounds
If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This list of users can be queried from PostgreSQL:
sql SELECT name FROM users WHERE passwordhash IS NOT NULL AND deactivated = 1;