CVE-2024-37303

Executive Summary

CVE-2024-37303 is a design-level vulnerability in Synapse, the open-source Matrix homeserver, affecting versions prior to 1.106. The flaw allows any unauthenticated remote participant to trigger the download and caching of remote media from a remote homeserver into the local media repository. Once cached, this content becomes available for download from the local homeserver without authentication. This enables unauthenticated remote adversaries to plant arbitrary, potentially malicious or policy-violating content into the media repository. The CVSS score is 5.3 (Medium), reflecting the low complexity and network-based attack vector, but limited impact on integrity. The official patch in version 1.106 introduces authenticated media download endpoints as a partial mitigation, with unauthenticated endpoints scheduled for removal in a future release.

Supply Chain & Package Security

Synapse is a Python-based package distributed via PyPI. Organizations should verify the integrity of the package using checksums provided by the Matrix.org project and ensure that only signed, official releases are deployed. The vulnerability is not a supply chain injection but a design flaw in the media federation protocol. However, the ability for unauthenticated users to plant content could be leveraged to distribute malicious payloads, making package integrity verification and content scanning critical.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected resource.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Unauthorized modification of media repository content is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but only allows integrity compromise of the media repository, not data theft or service disruption. However, the planted content could be used for phishing, malware distribution, or policy violations.

Deep Dive & Mechanics

The vulnerability stems from the Matrix federation protocol’s design for media sharing. When a user on a remote homeserver requests media from a local homeserver, the local server fetches and caches the media from the remote server. This process is triggered by unauthenticated requests, as the protocol historically allowed open federation for media. The cached media is then stored in the local media repository and made available for download without authentication.

The attack flow:

1. An attacker on a remote homeserver sends a request to the target Synapse server to fetch a media file from a malicious homeserver.
2. The target server downloads the media from the attacker-controlled server and caches it locally.
3. The attacker (or any unauthenticated user) can then download the cached media from the target server without authentication.
4. The planted content could be illegal images, malware, or propaganda, potentially causing legal or reputational damage.

The patch in version 1.106 introduces new endpoints (e.g., /_matrix/client/v1/media/download/) that require authentication. The old unauthenticated endpoints are frozen but still functional for backward compatibility. The full fix will remove unauthenticated endpoints in a future release.

Vulnerable vs. Patched Code

Vulnerable (pre-1.106): The media download endpoint /_matrix/media/v3/download/{serverName}/{mediaId} does not enforce authentication. The server fetches and caches media from remote servers without verifying the requester’s identity.

# Vulnerable handler (simplified)
async def on_GET(request, server_name, media_id):
    # No authentication check
    media = await self.media_repo.fetch_remote_media(server_name, media_id)
    return web.Response(body=media.body, content_type=media.content_type)

Patched (1.106+): The new authenticated endpoint /_matrix/client/v1/media/download/{serverName}/{mediaId} requires a valid access token. The old endpoint is frozen but still functional.

# Patched handler (simplified)
async def on_GET_authenticated(request, server_name, media_id):
    # Authentication required
    user = await self.auth.get_user_by_req(request)
    media = await self.media_repo.fetch_remote_media(server_name, media_id)
    return web.Response(body=media.body, content_type=media.content_type)

Exploitation & Lab Setup

Red Team (Adversarial Simulation)

Lab Setup:

• Target: Synapse 1.105 (vulnerable) running on Ubuntu 22.04.
• Attacker: Kali Linux with Python and requests library.
• Malicious homeserver: A simple HTTP server serving a test file.

Exploitation Steps:

1. Set up a malicious homeserver that hosts a file (e.g., malicious.png).
2. From the attacker machine, send an unauthenticated request to the target Synapse server to fetch the malicious file:

   curl -X GET "http://target-synapse:8008/_matrix/media/v3/download/malicious-server/malicious.png"
   

3. The target server downloads and caches the file.
4. Any unauthenticated user can now download the cached file:

   curl -X GET "http://target-synapse:8008/_matrix/media/v3/download/target-synapse/malicious.png"
   

Expected Outcome: The attacker successfully plants content in the target’s media repository without authentication.

Blue Team (Defensive Measures)

Detection:

• Monitor for requests to /_matrix/media/v3/download/ from unknown or suspicious IPs.
• Alert on high volumes of media fetch requests from the same source.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Immediately upgrade to Synapse 1.106 or later.
• If upgrade is not possible, restrict access to the media endpoints using a reverse proxy (e.g., Nginx) with IP whitelisting or authentication.
• Enable logging for all media download requests and review regularly.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unauthenticated GET requests to /_matrix/media/v3/download/ from external IPs.
  • Requests to /_matrix/media/v3/download/ with serverName pointing to known malicious or suspicious homeservers.
• File IOCs:
  • Unexpected media files in the Synapse media store directory (default: /var/lib/synapse/media_store/).
  • Files with unusual MIME types or content that violates content policies.
• Log IOCs:
  • Synapse logs showing repeated media fetch attempts from the same remote server.
  • Log entries with level=WARNING or ERROR related to media download failures from unknown servers.

Detection Engineering

YARA Rule

rule CVE_2024_37303_Media_Planting {
    meta:
        description = "Detects attempts to exploit CVE-2024-37303 by planting media via unauthenticated requests"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37303"
    strings:
        $s1 = "/_matrix/media/v3/download/" ascii wide nocase
        $s2 = "GET" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-37303 Unauthenticated Media Download Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to the Synapse media download endpoint, indicating potential exploitation of CVE-2024-37303.
author: Valters IT
date: 2024-07-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37303
logsource:
    category: webserver
    product: synapse
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/_matrix/media/v3/download/'
    condition: selection
falsepositives:
    - Legitimate unauthenticated media downloads from trusted homeservers (pre-patch behavior)
level: medium
tags:
    - attack.t1190
    - cve.2024.37303

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37303 Synapse Unauthenticated Media Download Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/_matrix/media/v3/download/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Synapse to version 1.106 or later.
2. If upgrade is delayed, configure a reverse proxy (e.g., Nginx) to require authentication for /_matrix/media/v3/download/ endpoints.
3. Review and clean the media repository for any suspicious content.

Long-term Measures:

• Monitor for the removal of unauthenticated endpoints in future Synapse releases.
• Implement content scanning for all media uploaded to the repository.
• Restrict federation to trusted homeservers only.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.