PT-2023-13719 · Synapse+3 · Synapse+3

Kasak · Published 2023-05-24 · Updated 2025-04-22 · CVE-2022-39335

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions up to and including 1.68.0

Description The Matrix Federation API in Synapse allows remote homeservers to request authorization events in a room, which is necessary for validating the legitimacy and permission of events. However, in affected versions, a Synapse homeserver does not sufficiently check if the requesting server should be able to access these events. This issue can be exploited when a malicious actor knows the ID of a target room and the ID of an event from that room. The issue is of negligible consequence for public rooms and deployments in a closed federation where all homeservers are trustworthy.

Recommendations For Synapse versions up to and including 1.68.0, upgrade to Synapse 1.69.0 to resolve the issue. As a temporary workaround, consider configuring Synapse with a list of trusted servers using the federation domain whitelist to restrict access, but this is not practical for homeservers participating in open federation.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

ALT-PU-2023-4748

CVE-2022-39335

GHSA-45CJ-F97F-GGWV

PYSEC-2023-65

USN-7444-1

Affected Products

Alt Linux

Linuxmint

Synapse

Ubuntu

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39335.json · Exploit
• https://github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv · Vendor Advisory
• https://github.com/matrix-org/synapse/pull/13823 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/T2MBNMZAFY4RCZL2VGBGAPKGB4JUPZVS · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39335 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39335 · Security Note
• https://osv.dev/vulnerability/USN-7444-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39335 · Security Note
• https://ubuntu.com/security/CVE-2023-42453 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39335 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7444-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-39335 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-65 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53863 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39335 · Vendor Advisory