CVE-2023-32323: matrix-org synapse Improper Input Validation

Vulnerability summary

CVE-2023-32323 is a medium (CVSS 5.0) Improper Input Validation vulnerability in matrix-org synapse. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-05-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. In versions of Synapse up to and including 1.73, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event. Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.