CVE-2024-52815

Advisory

Affected versions of Synapse are vulnerable to improper input validation (CWE-20). This flaw allows a malicious server to send specially crafted invites over federation, disrupting the invited user's /sync functionality. The vulnerability can be exploited remotely via federation invites targeting the invite handling methods. To mitigate, update to Synapse version 1.120.1, which rejects invalid invites and restores sync functionality. As a workaround, server administrators can disable federation from untrusted servers.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-f3r3-h2mq-hx2h
• https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52815