Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Vulnerability

CVE-2023-32323 is a flaw in Synapse, the open-source Matrix homeserver. The root cause is that Synapse versions up to and including 1.73 did not enforce any size limits on the invite_room_state field within invite events [2]. This allowed any user with permission to create certain state events to generate an arbitrarily large invite event, which could then be used to disrupt outbound federation.

Exploitation

An attacker must be a malicious user on a Synapse homeserver X and have permission to create state events (typically a room admin or moderator) [2]. The attack does not require authentication from external servers; it targets the sending server's own processing of invite events. By crafting an oversized invite_room_state, the attacker can cause the server to fail when sending the invite to another homeserver Y, effectively disabling outbound federation from X to Y. Synapse instances with federation disabled are not affected [2].

Impact

A successful attack allows the malicious user to selectively break federation between their homeserver and any arbitrary target homeserver Y [2]. This can isolate users on Y from communicating with users on X, breaking interoperability that is central to the Matrix protocol. The impact is limited to outbound federation; inbound federation is not affected by this vulnerability.

Mitigation

Synapse 1.74, released on 2022-12-13, refuses to create oversized invite_room_state fields, closing the attack vector [1][2]. Server operators are urged to upgrade to Synapse 1.74 or newer urgently [2]. No workaround is available for earlier versions, as the fix requires server-side enforcement of size limits.