| Package | Affected versions | Patched versions |
|---|---|---|
| matrix-synapse | < 1.74.0 | 1.74.0 |
| synapse | < 1.74.0 | 1.74.0 |
A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y.
Synapse instances with federation disabled are not affected.
The Matrix protocol allows homeservers to provide an invite_room_state field on a room invite containing a summary of room state. In versions of Synapse up to and including v1.73.0, Synapse did not limit the size of invite_room_state, meaning that it was possible to create an arbitrarily large invite event.
An attacker with an account on a vulnerable Synapse homeserver X could exploit this by having X create an over-sized invite event in a room with a user from another homeserver Y. Once acknowledged by the invitee's homeserver, the invite event would be sent in a batch of events to Y. If the malicious invite is so large that the entire batch is rejected as too large, X's outgoing traffic to Y would become "stuck", meaning that messages and state events created by X would remain unseen by Y.
Synapse 1.74 refuses to create oversized invite_room_state fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
There are no robust workarounds.
This attack needs an account on Synapse homeserver X to deny federation from X to another homeserver Y. As a partial mitigation, Synapse operators can disable open registration to limit the ability of attackers to create new accounts on homeserver X.
If homeserver X has been attacked in this way, restarting it will resume outgoing federation by entering "catchup mode". For catchup mode to ignore the oversized invites, every attacked room must have a correctly-sized event sent by X which is newer than any oversized invite. This is difficult to arrange, and does not prevent the attacker from repeating their attack.
If you have any questions or comments about this advisory, e-mail us at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free