Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-p9qp-c452-f9r7

MediumCVSS 6.5 / 10
Published May 24, 2023·Last modified Sep 30, 2024
Affected Components(0)

No affected components available

Description

Impact

If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected.

Synapse homeservers are affected by this issue if and only if they are joined to rooms which members of untrusted homeservers are joined or invited to.

  • Synapse homeservers in rooms available over public federation are affected.
  • Synapse homeservers with federation disabled are not affected.
  • Synapse homeservers in a closed federation containing only trusted servers are not affected.
  • Synapse homeservers which are only joined to rooms with federation disabled[^1] are not affected.

Patches

Administrators of homeservers with federation enabled are advised to upgrade to 1.68.0 or higher.

Workarounds

  • Federation can be disabled by setting federation_domain_whitelist to an empty list ([]). from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

References

  • https://github.com/matrix-org/synapse/pull/13723

[^1]: See m.federate in the m.room.create definition.

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.

Risk Scores
Base Score
6.5

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the availability of the system.

Threat Intelligence
6.0

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities
  • CVE-2022-39374
    Alias
  • EUVD-2023-0138
    Alias

Browse More

Medium severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard