« Volver al listado

CVE-2024-37302

Estado: AnalizadaAlta (7.5)—

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota sin autenticación (AV:N/PR:N/UI:N) en aplicación web expuesta. La explotación induce descarga masiva de caché causando agotamiento de disco (CWE-770), clásico DoS por consumo de recursos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Matrix — Synapse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37302",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37302",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-03T18:55:21.581964Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "element-hq",
          "product": "synapse",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.106"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:element-hq:synapse:*:*:*:*:*:*:*:*"
          ],
          "vendor": "element-hq",
          "product": "synapse",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.106",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-12-03T17:15:10.733",
  "references": [
    {
      "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new \"leaky bucket\" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached."
    },
    {
      "lang": "es",
      "value": "Synapse es un servidor doméstico Matrix de código abierto. Las versiones de Synapse anteriores a la 1.106 son vulnerables a un ataque de llenado de disco, en el que un adversario no autenticado puede inducir a Synapse a descargar y almacenar en caché grandes cantidades de medios remotos. La estrategia de límite de velocidad predeterminada no es suficiente para mitigar esto. Esto puede provocar una denegación de servicio, que puede ir desde el fallo de las futuras cargas/descargas de medios hasta la indisponibilidad total del proceso Synapse, según cómo se haya implementado Synapse. Synapse 1.106 introduce un nuevo límite de velocidad de \"depósito con fugas\" en las descargas de medios remotos para reducir la cantidad de datos que un usuario puede solicitar a la vez. Esto no soluciona por completo el problema, pero sí limita la capacidad de un usuario no autenticado de solicitar que se almacenen en caché grandes cantidades de datos."
    }
  ],
  "lastModified": "2026-06-17T07:38:06.163",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7574431-51E3-465D-A1B9-5D05FD28160B",
              "versionEndExcluding": "1.106.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}