CVE-2024-37303 Synapse unauthenticated writes to the media repository allow planting of problematic content
Unauthenticated attackers can plant problematic content in the media repository by triggering remote media downloads, requiring an upgrade to enforce authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37303?
CVE-2024-37303 is a medium-severity missing authorization vulnerability in element-hq synapse, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.
Weakness: CWE-306
Which versions are affected by CVE-2024-37303?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 1.106 |
matrix-synapse PyPI | All versions | 1.106 |
matrix-synapse PyPI | All versions | 1.106.0 |
Products include Matrix Synapse.
How do I fix CVE-2024-37303?
Upgrade matrix-synapse to a fixed version for your release line: 1.106 or 1.106.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-37303 being exploited?
There is no known exploitation of CVE-2024-37303 in the wild and no public exploit code.
Other vulnerabilities in element-hq synapse
- CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
- CVE-2024-37302 Synapse denial of service through media disk space consumption
Sources
Also known as GHSA-gjgr-7834-rhxr, PYSEC-2024-287, UBUNTU-CVE-2024-37303.