Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

Vulnerability

Details

In Synapse versions prior to 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats. This process may invoke external tools such as Ghostscript for decoding, significantly expanding the attack surface in a historically vulnerable area [1][3].

Exploitation

An attacker can craft a request that forces Synapse to generate thumbnails for an uncommon image format, potentially invoking external decoders like Ghostscript. No authentication is explicitly required beyond the ability to submit media to the homeserver, making this accessible to any user who can upload or send content [3].

Impact

By exploiting vulnerabilities in external decoders (e.g., Ghostscript), an attacker could achieve arbitrary code execution or other malicious outcomes. The advisory notes that this risk far outweighs the benefit of supporting rare image formats, which are seldom used on the open web or within the Matrix ecosystem [1][3].

Mitigation

The vulnerability is fixed in Synapse 1.120.1, which restricts thumbnail generation to widely used formats: PNG, JPEG, GIF, and WebP. As a workaround, administrators should ensure any image codecs and helper programs (such as Ghostscript) are patched against security vulnerabilities, or uninstall unused decoders from the system environment. The official Docker container image does not include Ghostscript [3].