Synapse allows unsupported content types to lead to memory exhaustion

Vulnerability

Description

CVE-2024-52805 affects Synapse, an open-source Matrix homeserver. The vulnerability lies in how the server handles multipart/form-data requests. In certain configurations, processing such requests can cause a transient, sharp increase in memory consumption beyond expected levels [1]. This memory amplification is the root cause, exploited to launch denial-of-service attacks.

Exploitation and

Attack Surface

An attacker can exploit this by sending specially crafted multipart/form-data requests to a vulnerable Synapse instance. No special authentication or network position is required; the attack can be launched remotely over the network. The effect is amplified memory usage during request processing, potentially exhausting server resources and impacting service availability for legitimate users [1].

Impact

Successful exploitation leads to a denial-of-service condition. The attacker can amplify the memory impact of their requests, overwhelming the server's capacity and causing degraded performance or complete unavailability of the Matrix homeserver service. This affects all users relying on that Synapse instance.

Mitigation

Synapse version 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type altogether [1]. Users should upgrade to at least version 1.120.1 to eliminate the attack vector. For those unable to immediately upgrade, reviewing and restricting multipart/form-data handling may be considered, though no official workaround is documented.