Cloudanix VulnDB

CVE-2024-37302

High · 7.5

Synapse denial of service through media disk space consumption

CVSS

7.5

EPSS

0.6%

Published

Dec 3, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Attackers can overwhelm a chat server's storage by tricking it into downloading huge files, causing the service to stop working.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unauthenticated remote attackers can force the Synapse server to repeatedly download and persistently cache arbitrarily large volumes of remote media files, bypassing insufficient default rate limits and exhausting available disk space.

Why it matters to the business

Service disruption ranging from blocked media operations to complete server unavailability, potentially affecting user communications in affected deployments; high ecosystem prevalence increases exposure for organizations relying on Synapse-based services.

How an attack unfolds

An attacker identifies a Synapse server and issues repeated unauthenticated requests that reference large remote media objects; the server downloads and caches each object due to weak rate limiting, gradually filling disk until media operations or the entire process fails.

How to fix it

Upgrade element-hq/synapse to the version containing commit e26673fe971a4d0316723b0e9ab487297db359f2 or later; apply additional rate-limiting controls on media endpoints until upgraded.

How to confirm the fix worked

Verify the deployed commit hash or version string matches or exceeds the fixed commit; test by attempting controlled large-media requests and confirming rate limits now prevent unbounded caching.

Typical attack path

  1. Locate an internet-exposed Synapse instance running a vulnerable version
  2. Craft and send unauthenticated requests referencing large remote media files
  3. Repeat requests at a rate that exceeds default limits
  4. Monitor for disk exhaustion and resulting denial of service

How to detect it

Inspect server logs for high volumes of unauthenticated remote media download requests; correlate with rapid increases in media cache directory size and disk utilization metrics.

What your security team should do

  • Upgrade to the fixed commit immediately given the 680-day window since publication
  • Implement stricter rate limits on unauthenticated media requests
  • Monitor disk usage trends and set alerts for anomalous growth in the media cache directory

The record

Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed.

Affected packages

Ecosystem Package Introduced Fixed
PyPI matrix-synapse 0 1.106
Debian:13 matrix-synapse 0 1.116.0-1
Ubuntu:20.04:LTS matrix-synapse 0 No fix
Ubuntu:22.04:LTS matrix-synapse 0 No fix
Ubuntu:24.04:LTS matrix-synapse 0 No fix
Ubuntu:24.10 matrix-synapse 0 No fix
Ubuntu:Pro:18.04:LTS matrix-synapse 0 No fix
Ubuntu:Pro:20.04:LTS matrix-synapse 0 No fix
Ubuntu:Pro:22.04:LTS matrix-synapse 0 No fix
openSUSE:Tumbleweed matrix-synapse 0 1.120.2-1.1

Related vulnerabilities