CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
A malicious user can disable outbound federation to specific hosts by sending oversized invite events, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32323?
CVE-2023-32323 is a medium-severity denial of service vulnerability in matrix-org synapse, published on 26 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
Weakness: CWE-20
Which versions are affected by CVE-2023-32323?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.74.0 |
matrix-synapse PyPI | All versions | 1.74.0 |
matrix-synapse PyPI | All versions | 1.74.0 |
Products include Matrix Synapse.
How do I fix CVE-2023-32323?
Upgrade matrix-synapse to 1.74.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-32323 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32323 exists.
Other vulnerabilities in matrix-org synapse
- CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
- CVE-2024-37302 Synapse denial of service through media disk space consumption
Sources
Also known as GHSA-f3wc-3vxv-xmvr, PYSEC-2023-67, UBUNTU-CVE-2023-32323.