CVE-2024-37303

Advisory

Affected versions of Synapse are vulnerable to Missing Authentication for Critical Function (CWE-306). This flaw allows unauthenticated remote users to download and cache media on the local repository, making such content accessible without authentication. The attack is executed via unauthenticated media download endpoints, enabling remote exploitation without credentials. To mitigate this issue, upgrade to Synapse version 1.106 or later, which requires authentication for media downloads. Additionally, server operators can apply stricter IP-based rate limits as a temporary workaround.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-gjgr-7834-rhxr
• https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37303