Cloudanix VulnDB

CVE-2024-53863

None

Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

CVSS

—

EPSS

0.6%

Published

Dec 3, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A server used for chat and collaboration needs an update to stop it from accidentally processing unusual image files that could open security holes.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Other
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Enabling dynamic_thumbnails or sending crafted requests causes Synapse to decode uncommon image formats and invoke external tools such as Ghostscript for thumbnail generation, expanding the attack surface in image processing code.

Why it matters to the business

Organizations running Synapse face elevated risk of server compromise through image-handling code; the low but non-zero exploit probability and absence from known campaigns still warrant prompt patching to avoid operational disruption.

How an attack unfolds

An attacker sends a specially crafted HTTP request containing an uncommon image format to a Synapse instance with dynamic_thumbnails enabled; the server passes the data to Pillow and external helpers such as Ghostscript, triggering unintended code paths that historically have been vulnerable.

How to fix it

Upgrade element-hq/synapse to version 1.120.1 or later, or apply commit fe3d88b833f76742874642c119b14b788341c905; disable the dynamic_thumbnails option until the update is complete.

How to confirm the fix worked

Confirm the running version reports 1.120.1 or newer; verify dynamic_thumbnails is disabled or test that uncommon image formats no longer trigger external tool invocation; review changelog for the cited commit.

Typical attack path

  1. Identify a Synapse server with dynamic_thumbnails enabled
  2. Craft a request embedding an uncommon image format listed in Pillow documentation
  3. Submit the request to trigger thumbnail generation
  4. Observe or exploit side effects from the invoked external tool such as Ghostscript

How to detect it

Review Synapse access and error logs for requests that trigger thumbnail generation of non-standard formats; inspect process execution logs for unexpected calls to Ghostscript or similar helpers; correlate with unusual thumbnail cache activity.

What your security team should do

  • Immediately schedule upgrade to 1.120.1 or the referenced commit for all Synapse deployments
  • Temporarily disable dynamic_thumbnails if upgrade cannot be performed within 48 hours
  • Audit image-processing dependencies and external tools for separate hardening
  • Monitor vendor announcements for any follow-on security updates

The record

In Synapse versions before 1.120.1, enabling the `dynamic_thumbnails` option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem. For a list of image formats, as well as decoding libraries and helper programs used, see [the Pillow documentation](https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html).

Affected packages

Ecosystem Package Introduced Fixed
PyPI matrix-synapse 0 1.120.1
Debian:13 matrix-synapse 0 1.121.0-1
Ubuntu:20.04:LTS matrix-synapse 0 No fix
Ubuntu:22.04:LTS matrix-synapse 0 No fix
Ubuntu:24.04:LTS matrix-synapse 0 No fix
Ubuntu:24.10 matrix-synapse 0 No fix
Ubuntu:Pro:18.04:LTS matrix-synapse 0 No fix
Ubuntu:Pro:22.04:LTS matrix-synapse 0 1.53.0-1ubuntu0.1~esm2
openSUSE:Tumbleweed matrix-synapse 0 1.120.2-1.1

Related vulnerabilities