Matrix Synapse any version

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.

Synapse allows a a malformed invite to break the invitee's `/sync`

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Synapse allows unsupported content types to lead to memory exhaustion

Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the room's state, the impact is long-lasting and is not fixed by an upgrade to a newer version, requiring the event to be manually redacted instead. Since events are replicated to servers of other room members, the impact is not constrained to the server of the event sender.

Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.

The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.

Path traversal in Matrix Synapse

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.

Synapse vulnerable to federation denial of service via malformed events

Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules

Synapse denial of service through media disk space consumption

Denial of service attack via incorrect parameters to federation APIs

Denial of service attack via .well-known lookups

URL previews can crash Synapse media repositories or Synapse monoliths

Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

Synapse's V2 state resolution weakness allows DoS from remote room members

Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Uncontrolled Resource Consumption in Matrix Synapse

Open redirect via transitional IPv6 addresses on dual-stack networks

AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.

Open redirects on some federation and push requests

HTML injection in email and account expiry notifications

Improper checks for deactivated users during login in synapse

URL deny list bypass via oEmbed and image URLs when generating previews in Synapse

Denial of service in Matrix Synapse

Synapse vulnerable to leak of remote user device information

Synapse unauthenticated writes to the media repository allow planting of problematic content

Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Synapse does not apply enough checks to servers requesting auth events of events in a room

matrix-synapse vulnerable to denial of service due to malicious server ACL events

Improper validation of receipts allows forged read receipts in matrix synapse

Temporary storage of plaintext passwords during password changes in matrix synapse

Improper authorisation of /members discloses room membership to non-members

Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.