CVE-2023-32323mediumCWE-20

CVE-2023-32323: medium-severity vulnerability in matrix-org synapse

Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Published · Updated

Follow this CVE+ Monitor synapse+ Monitor matrix-synapse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 1.0%
In short

A malicious user on a Matrix Synapse server can send specially crafted invitations to disable communication between that server and another server. This breaks federation, preventing legitimate message exchange between the two servers.

Technical detail

A local attacker with state event creation permissions can craft oversized `invite_room_state` fields in room invitations to trigger denial-of-service conditions that disable outbound federation to a targeted homeserver. Pre-conditions include federation enablement and attacker permissions; mitigation requires upgrading to Synapse 1.74+ to enforce size limits on invite event payloads.

Summary generated and translated by AI from the official description.
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Affected products
matrix-org · synapse
Related CVEs — matrix-org synapse

In the same product, most dangerous first.

CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2021-21274MEDIUMDenial of service attack via .well-known lookupsEPSS 2.2%CVE-2021-21273LOWOpen redirects on some federation and push requestsEPSS 1.8%CVE-2022-31052MEDIUMURL previews can crash Synapse media repositories or Synapse monolithsEPSS 1.7%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%