Synapse does not apply enough checks to servers requesting auth events of events in a room

Vulnerability

Description

In Synapse versions up to and including 1.68.0, the Matrix Federation API endpoint for querying authorization events in a room fails to properly verify that the requesting homeserver is authorized to access those events. This allows a remote homeserver to request authorization events for rooms it is not part of, potentially leaking sensitive information about room membership and permissions [1][2].

Exploitation

The vulnerability is exploitable over the Matrix federation protocol, which is typically open to the internet to allow server-to-server communication. No authentication or special privileges are required beyond being a remote homeserver that can send federation requests. The attacker simply sends a request for authorization events for a target room, and the vulnerable server responds without performing adequate access control checks [1][4].

Impact

Successful exploitation leads to unauthorized disclosure of authorization events for any room on the vulnerable homeserver. This includes state events that define room membership, permissions, and other sensitive configuration data. Such information could be used to gain insights into room structure and potentially exploit further vulnerabilities [2][4].

Mitigation

The issue has been patched in Synapse version 1.69.0. Administrators are strongly advised to upgrade to this version or later. No workarounds are currently available, and the vulnerability is fixed by enforcing proper authorization checks on federation API queries [1][2].