CVE-2023-32323 : Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a S

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.

Published 2023-05-26 14:15:11

Updated 2023-09-18 04:15:09

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Exploit prediction scoring system (EPSS) score for CVE-2023-32323

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32323

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
5.0	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L	3.1	1.4	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2023-32323

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by:

nvd@nist.gov (Secondary)
security-advisories@github.com (Primary)

References for CVE-2023-32323

https://github.com/matrix-org/synapse/security/advisories/GHSA-f3wc-3vxv-xmvr

Outgoing federation to specific hosts can be disabled by sending malicious invites · Advisory · matrix-org/synapse · GitHub
Mitigation;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJIJRP5ZH6B3KGFLHCAKR2IX2Y4Z25QD/

[SECURITY] Fedora 37 Update: python-matrix-common-1.3.0-7.fc37 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://github.com/matrix-org/synapse/pull/14642

Allow selecting "prejoin" events by state keys by DMRobertson · Pull Request #14642 · matrix-org/synapse · GitHub
Patch
https://github.com/matrix-org/synapse/issues/14492

Federation was broken between my homeserver and matrix.org (and I fixed it with this patch) · Issue #14492 · matrix-org/synapse · GitHub
Exploit;Issue Tracking

Products affected by CVE-2023-32323

Matrix » Synapse
Versions before (<) 1.74.0
cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2023-32323

Exploit prediction scoring system (EPSS) score for CVE-2023-32323

CVSS scores for CVE-2023-32323

CWE ids for CVE-2023-32323

References for CVE-2023-32323

Products affected by CVE-2023-32323