CVE-2022-41952

Executive Summary

CVE-2022-41952 is an uncontrolled resource consumption vulnerability in Matrix Synapse, a popular open-source Matrix homeserver implementation. Versions prior to 1.52.0 with URL preview functionality (url_preview_enabled: true) will open connections to media stream URLs (e.g., Icecast servers) without any connection timeout, terminating connections only after max_spider_size (default 10 MB) has been downloaded. This allows a single message containing a streaming media URL to trigger long-lived network connections from any Synapse instance with URL preview enabled, enabling a low-effort amplification attack that can cause excessive traffic and connection exhaustion toward targeted streaming servers. The attack requires no authentication and can be amplified by posting such URLs to rooms containing many Synapse instances. The fix in 1.52.0 introduces a 30-second connection timeout, and 1.53.0 additionally restricts URL preview attempts to a configurable allow list of content types (since media streams are never successfully previewed anyway).

Technical Analysis

Vulnerability Class: CWE-400 — Uncontrolled Resource Consumption (specifically, missing timeout in outbound network operations).

Affected Component: Matrix Synapse URL preview functionality. When url_preview_enabled is set to true in the Synapse configuration file, the homeserver attempts to generate metadata (title, description, thumbnail) for URLs posted in chat messages. This feature fetches the remote resource and inspects its content.

Vulnerability Mechanism: The URL preview fetch logic in Synapse versions before 1.52.0 does not impose a connection or response-read timeout. The only termination condition is the byte limit imposed by max_spider_size (default 10,000,000 bytes). For a standard web page, this limit is reached quickly because the content is finite. However, for media stream URLs (e.g., Shoutcast/Icecast audio streams), the server responds with a continuous, unbounded byte stream. Because the stream never terminates and the response is not bounded by any content-type restriction, Synapse will continue downloading the stream until max_spider_size bytes have been received. For streams at typical bitrates (e.g., 128 kbps), downloading 10 MB takes approximately 10 minutes. For slower streams, the connection may persist even longer — the 30-second timeout added in 1.52.0 exists precisely because in some cases 10 MB of stream data can take significantly more than 30 seconds to transfer.

Key technical details from the NVD description:

• The connection is terminated only after max_spider_size (default: 10M) bytes have been downloaded.
• Long-lived connections toward streaming media servers (Icecast is cited as an example) are the primary effect.
• Version 1.52.0 implements a 30-second connection timeout.
• Version 1.53.0 adds a content-type allow list, restricting which response content types will even be considered for URL preview generation.

Attack Surface: Any publicly reachable Synapse instance (version < 1.52.0) with url_preview_enabled: true. The default configuration has URL preview disabled, so this is not a default-on vulnerability. However, URL preview is a commonly enabled feature in community homeservers where links are shared frequently.

Amplification Factor: If a streaming media URL is posted to a large public room (e.g., a Matrix room with thousands of members spread across many federated homeservers), each Synapse instance that receives the message and has URL preview enabled will independently initiate a connection to the streaming server. A single message can therefore trigger hundreds or thousands of concurrent long-lived connections to the target streaming server, constituting a distributed denial-of-service vector against that server.

Exploitation Scenarios

Attack Chain (inferred from NVD description; no public PoC available):

Step 1 — Reconnaissance / Target Identification: The attacker identifies a target streaming media server (e.g., an Icecast server broadcasting an audio stream). The attacker also identifies one or more Matrix rooms where messages federate to many distinct Synapse homeservers that have url_preview_enabled set to true. Large public rooms with broad federation are ideal because each participating homeserver will independently attempt a URL preview.

Step 2 — Triggering the Vulnerability: The attacker posts a message containing the streaming media URL (e.g., http://target-stream.example.com:8000/stream) to the chosen room. The URL must point directly at the media stream endpoint, not an HTML page containing a stream player. The media server responds with a Content-Type that is not restricted by the vulnerable Synapse version (pre-1.53.0 versions will attempt previews for any content type), and the stream begins sending an unbounded byte stream to the requesting Synapse instance.

Step 3 — Execution at Vulnerability-Class Level (Uncontrolled Resource Consumption): Each Synapse instance's URL preview module connects to the target host and begins reading the response body. Since no timeout is enforced, the connection remains open until max_spider_size (10 MB) has been received. For typical stream bitrates (96–320 kbps), this takes 4–15 minutes per connection. For slower streams (e.g., 24–48 kbps), the connection could persist substantially longer. The attacker does not need to maintain the connection — the damage propagates through the federation as each homeserver that processes the message independently initiates its own connection.

Step 4 — Post-Exploitation Impact: The target streaming server experiences connection exhaustion and bandwidth saturation. Each compromised Synapse instance acts as an unwitting participant in the DDoS attack, consuming its own outbound bandwidth and connection pool resources. The attack also degrades the performance of the affected Synapse instances themselves, as their URL preview workers are tied up in long-lived connections. The attacker incurs negligible cost — a single message post.

PoC Status: No public PoC, exploit code, or Nuclei template is available. The attack chain is inferred from the vulnerability class (uncontrolled resource consumption via missing network timeout) and the explicit technical details in the NVD description.

Impact Assessment

CVSS Score: 6.5 (Medium severity).

Primary Business Impact:

• Denial of Service (Availability): The most direct impact is availability loss for the target streaming server(s). A coordinated message post to a large federated room can generate a significant volume of long-lived connections to a single host.
• Resource Exhaustion on Synapse Instances: Each affected Synapse instance consumes outbound bandwidth, file descriptors, and URL preview worker resources for the duration of each preview attempt. In high-traffic rooms, this can degrade preview responsiveness and overall homeserver performance.
• Bandwidth Costs: Operators of affected Synapse instances may incur elevated egress bandwidth costs, particularly for cloud-hosted deployments where bandwidth is metered.

Affected Systems:

• All Matrix Synapse homeservers running versions prior to 1.52.0 with url_preview_enabled: true.
• Target streaming media servers (Icecast, Shoutcast, similar) that are referenced in Matrix messages processed by vulnerable Synapse instances.

Blast Radius:

• Direct victims: The streaming media server targeted by URL posts.
• Indirect victims: Operators of vulnerable Synapse instances (resource consumption, bandwidth costs), and users of those homeservers (degraded URL preview performance).
• Amplification potential: A single message can trigger connections from every federated Synapse instance that processes the room message — the amplification factor scales with the size and federation depth of the room.

EPSS Context: EPSS score of 0.00827 (54.2% percentile) indicates low probability of exploitation in the wild. Not listed on CISA KEV.

Detection Guidance

Sigma Rule

title: Matrix Synapse URL Preview Long-Lived Connection Attempt
id: 1f9a7c3e-5d8b-4a6e-9c2f-8b1d4e7a9c13
status: experimental
description: Detects long-lived outbound connections from Synapse URL preview worker processes, potentially indicating CVE-2022-41952 exploitation
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/synapse'
        CommandLine|contains: 'url_preview'
    condition: selection
    timeframe: 10m
fields:
    - Image
    - CommandLine
    - ParentImage
falsepositives:
    - Legitimate URL preview of large media files
    - Preview of long-running web sockets
level: medium
tags:
    - attack.t1499
    - cve.2022.41952

YARA Rule

rule CVE_2022_41952_Synapse_URL_Preview_Timeout
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects log patterns associated with CVE-2022-41952 — long-running URL preview connections in Matrix Synapse"
        cve = "CVE-2022-41952"
        date = "2025-04-24"
        severity = "medium"
    strings:
        $s1 = "url preview" ascii nocase
        $s2 = "max_spider_size" ascii nocase
        $s3 = "url_preview_enabled" ascii nocase
        $s4 = "Timed out after" ascii nocase
        $s5 = "preview" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x7F45) and
        2 of ($s*) and filesize < 5MB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-41952 Matrix Synapse URL Preview Long Connection"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; flowbytes:server,0,10000000; threshold:type both, track by_src, count 1, seconds 300; classtype:attempted-dos; sid:2022041952; rev:1;)

Note: A more precise detection approach is a custom Suricata rule using the flowint keyword to track connection duration and bytes transferred, alerting when a single HTTP connection from Synapse to an external host exceeds 30 seconds and transfers more than 1 MB.

Elastic Detection

sequence by process.entity_id with maxspan=15m
  [network where process.name == "python" and 
   process.command_line like "*synapse*" and
   network.direction == "egress" and
   network.protocol == "http"]
  [network where process.name == "python" and
   network.direction == "egress" and
   network.duration > 60000]

Note: Requires ECS fields network.duration to be populated. Alternatively, use filebeat with network flow monitoring:

sequence by source.ip with maxspan=15m
  [network where destination.port == 80 or destination.port == 443]
  [network where destination.port == 80 or destination.port == 443 and
   network.bytes > 5000000]

Splunk SPL Query

index=netflow OR index=proxy
| where (dest_port=80 OR dest_port=443) AND src_ip IN (
    [search index=main sourcetype=linux_secure 
     | where process_name="*synapse*" 
     | stats values(src_ip) as src_ip]
  )
| stats count, sum(bytes_out), avg(duration) as avg_duration, max(duration) as max_duration by src_ip, dest_ip
| where max_duration > 300 OR sum(bytes_out) > 5000000
| sort - max_duration

Wazuh OSSEC Rule

<group name="synapse,">
  <rule id="100419" level="10">
    <if_sid>5715</if_sid>
    <match>url preview</match>
    <regex>Timed out|max_spider_size|preview</regex>
    <description>Matrix Synapse: URL preview connection exceeded expected duration or size threshold — possible CVE-2022-41952 exploitation</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve-2022-41952,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY (confirmed by 2 independent sources: CNA and OSV).

Immediate Mitigations (without patching):

1. Disable URL preview (most effective immediate action): Set url_preview_enabled: false in the Synapse configuration file and restart the homeserver. This fully mitigates CVE-2022-41952.
2. Network-level timeout enforcement: Place a reverse proxy (nginx, HAProxy, etc.) between Synapse and the internet with proxy_read_timeout 30s (nginx) or equivalent, which will terminate outbound URL preview connections at the proxy layer.
3. Firewall/egress filtering: Restrict outbound connections from Synapse to only ports 80/443, and consider rate-limiting outbound connections per destination IP.

Patch/Upgrade Steps:

1. Upgrade to 1.53.0 or later — this is the fully resolved version. Version 1.52.0 mitigates the issue by adding a 30-second timeout but still attempts previews for unsupported media stream content types; 1.53.0 adds the content-type allow list.
2. Upgrade path: review the official Matrix Synapse release notes and migration guide, then upgrade through your package manager (apt, pip, Docker image) or source build.

Long-Term Hardening:

1. Keep URL preview disabled unless explicitly required by your deployment's use case.
2. If URL preview must remain enabled, review and restrict the content-type allow list introduced in 1.53.0 (the configuration parameter is not explicitly named in the NVD description, but the feature exists).
3. Monitor outbound connection patterns from Synapse hosts. Long-lived connections (>30s) to ports 80/443 from URL preview workers should be flagged.
4. Subscribe to the Matrix Synapse security advisories channel for future disclosure notifications.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-41952
2. Matrix Synapse Security Advisory (via CNA): https://github.com/matrix-org/synapse/security/advisories (referenced as the CNA source; specific advisory ID unavailable in provided data)
3. OSV Entry: https://osv.dev/vulnerability/CVE-2022-41952 (confirmed patch via OSV source)
4. Matrix Synapse GitHub Repository: https://github.com/matrix-org/synapse (release notes for 1.52.0 and 1.53.0 contain fix details)
5. CISA KEV: Not listed (no CISA Known Exploited Vulnerabilities record as of this report — confirmed NO)

Threat Actor Activity: No known threat actor campaigns or exploitation-in-the-wild evidence have been identified for CVE-2022-41952. The EPSS score (0.00827) reflects a low probability of exploitation. The vulnerability is a relatively low-value DoS vector — it does not grant code execution, data access, or lateral movement, and it requires URL preview to be enabled, which is not a default configuration.