Cloudanix VulnDB

CVE-2024-53867

Medium · 4.3

CVSS

4.3

EPSS

0.4%

Published

Dec 3, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the chat server could let people who left a room still see some updates about who is in the room or how it is set up.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The Sliding Sync feature leaks partial room state changes to users who are no longer members of the room on affected Synapse versions.

Why it matters to the business

Organizations running Synapse may expose sensitive room metadata or configuration details to former participants, increasing risk of unintended information disclosure without affecting message content.

How an attack unfolds

An attacker who previously joined a room but later left can continue receiving partial state updates through the Sliding Sync API on versions 1.113.0rc1 through 1.120.0.

How to fix it

Upgrade Synapse to version 1.120.1 or later to resolve the Sliding Sync state leak.

How to confirm the fix worked

Confirm the running Synapse version is 1.120.1 or higher and verify that former room members no longer receive state event updates via Sliding Sync.

Typical attack path

  1. Join a room as a member
  2. Leave or be removed from the room
  3. Issue Sliding Sync requests to receive leaked state changes

How to detect it

Examine Synapse logs for Sliding Sync requests originating from non-members and inspect responses for unexpected state events after a user has left a room.

What your security team should do

  • Upgrade all Synapse instances to 1.120.1 immediately
  • Review room membership logs for recent departures
  • Monitor Sliding Sync traffic for anomalous state exposure

The record

Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.

Affected packages

Ecosystem Package Introduced Fixed
PyPI matrix-synapse 1.113.0rc1 1.120.1
Debian:13 matrix-synapse 0 1.121.0-1
Ubuntu:20.04:LTS matrix-synapse 0 No fix
Ubuntu:20.04:LTS matrix-synapse 0 1.11.0-1
Ubuntu:22.04:LTS matrix-synapse 0 No fix
Ubuntu:22.04:LTS matrix-synapse 0 1.53.0-1
Ubuntu:24.04:LTS matrix-synapse 0 No fix
Ubuntu:24.04:LTS matrix-synapse 0 1.100.0-1ubuntu1
Ubuntu:24.10 matrix-synapse 0 No fix
Ubuntu:Pro:18.04:LTS matrix-synapse 0 No fix
Ubuntu:Pro:18.04:LTS matrix-synapse 0 0.24.0+dfsg-1ubuntu0.1~esm1
openSUSE:Tumbleweed matrix-synapse 0 1.120.2-1.1
pypi matrix-synapse 1.113.0rc1 No fix

Related vulnerabilities