Homepage

matrix-synapse@1.68.0rc2 vulnerabilities

Homeserver for the Matrix decentralised comms protocol

  • latest version

    1.128.0

  • latest non vulnerable version

    1.128.0

  • first published

    6 years ago

  • latest version published

    11 days ago

  • licenses detected

  • View matrix-synapse package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the matrix-synapse package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Input Validation

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Improper Input Validation. A malicious server can disrupt the normal operation and prevent the application from federating with other servers by crafting events that exploit this flaw.

    Note:

    This is only exploitable in environments where federation is enabled.

    How to fix Improper Input Validation?

    Upgrade matrix-synapse to version 1.127.1 or higher.

    [,1.127.1)
    • H
    Improper Input Validation

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Improper Input Validation via invite messages. An attacker can disrupt the /sync functionality by sending a specially crafted invite over federation.

    How to fix Improper Input Validation?

    Upgrade matrix-synapse to version 1.120.2 or higher.

    [,1.120.2)
    • H
    Allocation of Resources Without Limits or Throttling

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the media download process. An attacker can induce the server to download and cache large amounts of remote media, leading to disk space exhaustion by sending repeated requests for large files.

    Note:

    This is only exploitable if the server has not implemented sufficient rate limiting or file size restrictions.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade matrix-synapse to version 1.106.0 or higher.

    [,1.106.0)
    • M
    Missing Authentication for Critical Function

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the unauthenticated writes to the media repository. An attacker can plant problematic content into the media repository by exploiting this functionality.

    How to fix Missing Authentication for Critical Function?

    Upgrade matrix-synapse to version 1.106.0 or higher.

    [,1.106.0)
    • H
    Arbitrary File Upload

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Arbitrary File Upload due to the dynamic_thumbnails option or processing a specially crafted request. An attacker can exploit this to execute arbitrary code or cause a denial of service by invoking external, potentially untrustworthy decoders.

    How to fix Arbitrary File Upload?

    Upgrade matrix-synapse to version 1.120.2 or higher.

    [,1.120.2)
    • H
    Allocation of Resources Without Limits or Throttling

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of multipart/form-data content types. An attacker can amplify denial of service attacks by sending crafted requests that transiently increase memory consumption.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade matrix-synapse to version 1.120.2 or higher.

    [,1.120.2)
    • M
    Allocation of Resources Without Limits or Throttling

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a weakness in how the auth chain cover index is calculated. An attacker can induce high CPU consumption and accumulate excessive data in the database by dispatching specially crafted events.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade matrix-synapse to version 1.105.1 or higher.

    [,1.105.1)
    • M
    Information Exposure

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Information Exposure. An attacker can query remote users' device information which can be used to enumerate the remote users known to a homeserver.

    How to fix Information Exposure?

    Upgrade matrix-synapse to version 1.95.1 or higher.

    [,1.95.1)
    • M
    Allocation of Resources Without Limits or Throttling

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ACL event. An attacker can cause a denial of service by sending a malicious ACL event.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade matrix-synapse to version 1.94.0rc1 or higher.

    [,1.94.0rc1)
    • M
    Improper Input Validation

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Improper Input Validation due to the improper validation of receipts. An attacker can forge read receipts for any event by knowing the room ID and event ID.

    How to fix Improper Input Validation?

    Upgrade matrix-synapse to version 1.93.0 or higher.

    [0.34.0,1.93.0)
    • M
    Information Exposure

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Information Exposure due to temporarily stored plaintext passwords in the server database. An attacker can potentially access these passwords if they have access to the database backups.

    How to fix Information Exposure?

    Upgrade matrix-synapse to version 1.93.0 or higher.

    [1.66.0,1.93.0)
    • M
    Incorrect Authorization

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Incorrect Authorization in that it does not check for deactivated status of users during login, under certain conditions. Specifically, JSON Web Tokens must be enabled via the jwt_config.enabled setting, the local password database must be enabled via the password_config.enabled and password_config.localdb_enabled settings, and a user's password must be updated via an admin API after a user is deactivated.

    NOTE: Installations configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.

    If not using JSON Web Tokens, the list of deactivated users with a password set can be queried from PostgreSQL:

    SELECT name FROM users WHERE password_hash IS NOT NULL AND deactivated = 1;

    How to fix Incorrect Authorization?

    Upgrade matrix-synapse to version 1.85.0rc1 or higher.

    [,1.85.0rc1)
    • L
    Server-side Request Forgery (SSRF)

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) by bypassing the url_preview_url_blacklist deny list with oEmbed or image URLs used in previews. An attacker can bypass the deny list by including an IP address that is allowed by the url_preview_ip_range_blacklist setting (only public addresses by default). The information exposed by the client is limited by the following conditions:

    • For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded.

    • For discovered image URLs, any non-image response is discarded.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade matrix-synapse to version 1.85.0rc1 or higher.

    [,1.85.0rc1)
    • M
    Denial of Service (DoS)

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Denial of Service (DoS) to specific hosts by sending malicious invites. A malicious homeserver can disable its outbound federation to a different homeserver by sending a very large invite_room_state value in a room invite.

    NOTE: Synapse instances with federation disabled are not affected.

    How to fix Denial of Service (DoS)?

    Upgrade matrix-synapse to version 1.74.0rc1 or higher.

    [,1.74.0rc1)
    • L
    Access Restriction Bypass

    matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP.

    Affected versions of this package are vulnerable to Access Restriction Bypass due to Synapse homeservers answering a query for authorisation events not sufficiently checking that the requesting server should be able to access them. Authorisation events include power level events (the list of user IDs and their power levels at the time) and relevant membership events (including the display name of the sender of that event), as well as events like m.room.create, m.room.third_party_invite and m.room.join_rules. Non-authorisation events are unaffected, so it isn't possible to extract message contents this way.

    NOTE: This issue is only exploitable when an attacker knows the ID of a target room and the ID of an event from that room, which increases the complexity of a realistic attack. Additionally, this issue is of negligible consequence for public rooms given that any server can easily join the roomand view authorisation events. Deployments in a closed federation where all homeservers are trustworthy are not affected.

    How to fix Access Restriction Bypass?

    Upgrade matrix-synapse to version 1.69.0rc1 or higher.

    [,1.69.0rc1)
    Go back to all versions of this package