Medium severity · published May 26, 2023
CVE-2022-39335
Synapse does not apply enough checks to servers requesting auth events of events in a room
5.0
CVSS
0.6%
EPSS
No
On KEV
Description
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to upgrade.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
synapse · matrix-org
< 1.69.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39335
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39335
Issue Tracking
https://github.com/matrix-org/synapse/issues/13288
Patch
https://github.com/matrix-org/synapse/pull/13823
Mitigation
https://github.com/matrix-org/synapse/security/advisories/GHSA-45cj-f97f-ggwv
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2MBNMZAFY4RCZL2VGBGAPKGB4JUPZVS/
More from synapse
7.5
CVE-2022-31152
Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
6.5
CVE-2022-39374
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
6.5
CVE-2022-31052
URL previews can crash Synapse media repositories or Synapse monoliths
5.4
CVE-2023-32683
URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
5.4
CVE-2023-32682
Improper checks for deactivated users during login in synapse