cvelistv5 - cve-2024-52805

cve-2024-52805

Vulnerability from cvelistv5

Published

2024-12-03 17:01

Modified

2024-12-03 19:04

Severity ?

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

References

▼	URL	Tags
	security-advisories@github.com	https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2
	security-advisories@github.com	https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518
	security-advisories@github.com	https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609

Impacted products

Vendor

Product

Version

▼

element-hq

synapse

Version: < 1.120.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:element-hq:synapse:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "synapse",
            "vendor": "element-hq",
            "versions": [
              {
                "lessThan": "1.120.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52805",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-03T19:04:05.237385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-03T19:04:44.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "synapse",
          "vendor": "element-hq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.120.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-03T17:01:50.119Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2"
        },
        {
          "name": "https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518"
        },
        {
          "name": "https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609"
        }
      ],
      "source": {
        "advisory": "GHSA-rfq8-j7rh-8hf2",
        "discovery": "UNKNOWN"
      },
      "title": "Synapse allows unsupported content types to lead to memory exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52805",
    "datePublished": "2024-12-03T17:01:50.119Z",
    "dateReserved": "2024-11-15T17:11:13.442Z",
    "dateUpdated": "2024-12-03T19:04:44.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-52805\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-12-03T17:15:12.120\",\"lastModified\":\"2024-12-03T17:15:12.120\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.\"},{\"lang\":\"es\",\"value\":\" Synapse es un servidor dom\u00e9stico Matrix de c\u00f3digo abierto. En Synapse anterior a la versi\u00f3n 1.120.1, las solicitudes multipart/form-data pueden, en determinadas configuraciones, aumentar transitoriamente el consumo de memoria m\u00e1s all\u00e1 de los niveles esperados mientras se procesa la solicitud, lo que se puede utilizar para amplificar los ataques de denegaci\u00f3n de servicio. Synapse 1.120.1 resuelve el problema al denegar las solicitudes con un tipo de contenido multipart/form-data no compatible.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"NONE\",\"vulnerableSystemIntegrity\":\"NONE\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

ghsa-rfq8-j7rh-8hf2

Vulnerability from github

Published

2024-12-03 18:40

Modified

2024-12-03 18:40

Severity ?

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

Synapse allows unsupported content types to lead to memory exhaustion

Details

Impact

In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.

Patches

Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.

Workarounds

Limiting request sizes or blocking the multipart/form-data content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low max_upload_size in Synapse.

References

https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518
https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609

For more information

If you have any questions or comments about this advisory, please email us at security at element.io.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.120.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-52805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-03T18:40:39Z",
    "nvd_published_at": "2024-12-03T17:15:12Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nIn Synapse before 1.120.1, `multipart/form-data` requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks.\n\n### Patches\n\nSynapse 1.120.1 resolves the issue by denying requests with unsupported `multipart/form-data` content type.\n\n### Workarounds\n\nLimiting request sizes or blocking the `multipart/form-data` content type before the requests reach Synapse, for example in a reverse proxy, alleviates the issue. Another approach that mitigates the attack is to use a low `max_upload_size` in Synapse.\n\n### References\n\n- https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518\n- https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n",
  "id": "GHSA-rfq8-j7rh-8hf2",
  "modified": "2024-12-03T18:40:39Z",
  "published": "2024-12-03T18:40:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-rfq8-j7rh-8hf2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52805"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/issues/4688#issuecomment-1167705518"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/issues/4688#issuecomment-2385711609"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/element-hq/synapse"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Synapse allows unsupported content types to lead to memory exhaustion"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2024-52805

Vulnerability from cvelistv5

ghsa-rfq8-j7rh-8hf2

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

Tags

Sightings

Nomenclature