PT-2024-35463 · Synapse · Synapse

Published 2024-12-03 · Updated 2025-08-26 · CVE-2024-52815

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.120.1

Description Synapse is an open-source Matrix homeserver. The issue arises from the failure to properly validate invites received over federation, allowing a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. This can be exploited by sending crafted invites, which Synapse 1.120.1 and later versions reject, thereby restoring the ability to sync for affected users.

Recommendations For versions prior to 1.120.1, update to Synapse 1.120.1 or later to protect the server's security and restore the ability to sync for affected users. As a temporary workaround, consider disabling federation from untrusted servers until the update can be applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-52815

GHSA-F3R3-H2MQ-HX2H

OPENSUSE-SU-2024:14541-1

Affected Products

Synapse

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52815.json · Exploit
• https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-52815 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-52815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52815 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14541-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52815 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52815 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f3r3-h2mq-hx2h · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52815 · Vendor Advisory
• https://github.com/element-hq/synapse · Note
• https://suse.com/security/cve/CVE-2024-37302 · Note
• https://suse.com/security/cve/CVE-2024-52815 · Note
• https://twitter.com/CveFindCom/status/1863992513788362964 · Twitter Post