PT-2024-27461 · Matrix · Synapse

Published 2024-12-03 · Updated 2025-08-26 · CVE-2024-37303

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.106

Description Synapse, an open-source Matrix homeserver, allows unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. This functionality enables unauthenticated remote adversaries to plant problematic content into the media repository, making it available for download from the local homeserver in an unauthenticated way. A partial mitigation is introduced in Synapse version 1.106, which includes new endpoints requiring authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.

Recommendations For Synapse versions prior to 1.106, update to version 1.106 or later to introduce partial mitigation through new authenticated endpoints for media downloads. As a temporary workaround, consider using more strict rate limits based on IP address to limit the potential impact.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-37303

GHSA-GJGR-7834-RHXR

OPENSUSE-SU-2024:14541-1

PYSEC-2024-287

Affected Products

Synapse

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37303.json · Exploit
• https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr · Vendor Advisory
• https://github.com/matrix-org/matrix-spec-proposals/pull/3916 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37303 · Security Note
• https://osv.dev/vulnerability/GHSA-gjgr-7834-rhxr · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-37303 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37303 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14541-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-37303 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-37303 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37303 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-37303 · Vendor Advisory
• https://github.com/element-hq/synapse · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2024-287.yaml · Note