CVE-2022-39374 Synapse Denial of service due to incorrect application of event authorization rules during state resolution
A malicious homeserver can cause a Synapse Matrix homeserver to reject all future messages in a shared room, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39374?
CVE-2022-39374 is a medium-severity denial of service vulnerability in matrix-org synapse, published on 26 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0
Weakness: CWE-400
Which versions are affected by CVE-2022-39374?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | From 1.62.0 | 1.68.0 |
matrix-synapse PyPI | From 1.62.0 | 1.68.0rc1 |
matrix-synapse PyPI | From 1.62.0 | 1.68.0rc1 |
Products include Matrix Synapse.
How do I fix CVE-2022-39374?
Upgrade matrix-synapse to a fixed version for your release line: 1.68.0 or 1.68.0rc1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-39374 being exploited?
There is no known exploitation of CVE-2022-39374 in the wild and no public exploit code.
Other vulnerabilities in matrix-org synapse
- CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
- CVE-2024-37302 Synapse denial of service through media disk space consumption
Sources
Also known as GHSA-p9qp-c452-f9r7, PYSEC-2023-66, UBUNTU-CVE-2022-39374.