Cloudanix VulnDB

CVE-2024-37303

Medium · 5.3

Synapse's unauthenticated writes to the media repository allow planting of problematic content

CVSS

5.3

EPSS

0.4%

Published

Dec 3, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A chat server can be tricked into automatically storing and sharing files from other servers without requiring login, letting outsiders plant unwanted content that anyone can then download.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits unauthenticated remote federation participants to force Synapse to fetch and cache arbitrary remote media into the local repository, after which the content is retrievable by anyone without authentication.

Why it matters to the business

Operators may host and serve problematic or illegal content through their media endpoints, raising legal exposure, moderation burden, and potential service reputation damage; the issue affects all Synapse deployments prior to the listed commit and remains exploitable until patched.

How an attack unfolds

An attacker on a remote homeserver initiates a media download request that targets the victim Synapse instance via Matrix federation; the server fetches and stores the content by design, after which the attacker or any unauthenticated client can retrieve it directly from the local media repository.

How to fix it

Upgrade element-hq/synapse to the commit e26673fe971a4d0316723b0e9ab487297db359f2 or later; after upgrade, review and purge any previously cached problematic media.

How to confirm the fix worked

Confirm the running Synapse binary or source matches or exceeds commit e26673fe971a4d0316723b0e9ab487297db359f2; test that previously public remote media now requires authentication or is unavailable.

Typical attack path

  1. Locate a Synapse instance reachable via federation
  2. Send a remote media download request from a controlled homeserver
  3. Confirm the content has been cached locally
  4. Retrieve the planted media via unauthenticated endpoint

How to detect it

Review Synapse media and federation logs for remote media download requests that originate from external homeservers and result in cache population; correlate with subsequent unauthenticated retrieval attempts.

What your security team should do

  • Apply the fixed commit immediately across all Synapse deployments
  • Audit media repositories for unexpected cached content
  • Enable or strengthen content scanning and moderation before re-enabling remote media features

The record

Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository.

Affected packages

Ecosystem Package Introduced Fixed
PyPI matrix-synapse 0 1.106
Debian:13 matrix-synapse 0 1.116.0-1
Ubuntu:20.04:LTS matrix-synapse 0 No fix
Ubuntu:22.04:LTS matrix-synapse 0 No fix
Ubuntu:24.04:LTS matrix-synapse 0 No fix
Ubuntu:24.10 matrix-synapse 0 No fix
Ubuntu:Pro:18.04:LTS matrix-synapse 0 No fix
Ubuntu:Pro:20.04:LTS matrix-synapse 0 No fix
Ubuntu:Pro:22.04:LTS matrix-synapse 0 No fix
openSUSE:Tumbleweed matrix-synapse 0 1.120.2-1.1

Related vulnerabilities