CVE-2024-37302

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-37302", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-05T20:10:46.497Z", "datePublished": "2024-12-03T17:04:15.839Z", "dateUpdated": "2024-12-03T18:56:17.082Z"}, "containers": {"cna": {"title": "Synapse denial of service through media disk space consumption", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x"}], "affected": [{"vendor": "element-hq", "product": "synapse", "versions": [{"version": "< 1.106", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-03T17:04:15.839Z"}, "descriptions": [{"lang": "en", "value": "Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new \"leaky bucket\" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached."}], "source": {"advisory": "GHSA-4mhg-xv73-xq2x", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "element-hq", "product": "synapse", "cpes": ["cpe:2.3:a:element-hq:synapse:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.106", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-03T18:55:21.581964Z", "id": "CVE-2024-37302", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T18:56:17.082Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-03T18:55:21.581964Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:element-hq:synapse:*:*:*:*:*:*:*:*"], "vendor": "element-hq", "product": "synapse", "versions": [{"status": "affected", "version": "0", "lessThan": "1.106", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T18:55:52.653Z"}}], "cna": {"title": "Synapse denial of service through media disk space consumption", "source": {"advisory": "GHSA-4mhg-xv73-xq2x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "element-hq", "product": "synapse", "versions": [{"status": "affected", "version": "< 1.106"}]}], "references": [{"url": "https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x", "name": "https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new \"leaky bucket\" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-03T17:04:15.839Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37302", "state": "PUBLISHED", "dateUpdated": "2024-12-03T18:56:17.082Z", "dateReserved": "2024-06-05T20:10:46.497Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-12-03T17:04:15.839Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "synapse", "vendor": "element-hq", "versions": [{"status": "affected", "version": "< 1.106"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:element-hq:synapse:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "synapse", "vendor": "element-hq", "versions": [{"lessThan": "1.106", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7574431-51E3-465D-A1B9-5D05FD28160B", "versionEndExcluding": "1.106.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new \"leaky bucket\" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached."}, {"lang": "es", "value": "Synapse es un servidor dom\u00e9stico Matrix de c\u00f3digo abierto. Las versiones de Synapse anteriores a la 1.106 son vulnerables a un ataque de llenado de disco, en el que un adversario no autenticado puede inducir a Synapse a descargar y almacenar en cach\u00e9 grandes cantidades de medios remotos. La estrategia de l\u00edmite de velocidad predeterminada no es suficiente para mitigar esto. Esto puede provocar una denegaci\u00f3n de servicio, que puede ir desde el fallo de las futuras cargas/descargas de medios hasta la indisponibilidad total del proceso Synapse, seg\u00fan c\u00f3mo se haya implementado Synapse. Synapse 1.106 introduce un nuevo l\u00edmite de velocidad de \"dep\u00f3sito con fugas\" en las descargas de medios remotos para reducir la cantidad de datos que un usuario puede solicitar a la vez. Esto no soluciona por completo el problema, pero s\u00ed limita la capacidad de un usuario no autenticado de solicitar que se almacenen en cach\u00e9 grandes cantidades de datos."}], "id": "CVE-2024-37302", "lastModified": "2026-06-17T07:38:06.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-37302", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-03T18:55:21.581964Z", "version": "2.0.3"}}]}, "published": "2024-12-03T17:15:10.733", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}