TI-2024-24815 Aliases CVE-2024-37303 GHSA-gjgr-7834-rhxr

Synapse unauthenticated writes to the media repository allow planting of problematic content

LOW 30CWE-306Published 2024-12-03 · Updated 2024-12-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0043 37th percentileScored 2026-11-07

Fix Fixed synapse (element-hq): 1.106matrix-synapse (PyPI): 1.106

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
element-hq	synapse	before 1.106	1.106	Patch available	CNA
—	matrix-synapse (PyPI)	before 1.106	1.106	Patch available	GHSA-gjgr-7834-rhxr

synapse Vendorelement-hq Affected before 1.106 Fixed in 1.106 Patch available CNA
matrix-synapse (PyPI) Vendor— Affected before 1.106 Fixed in 1.106 Patch available GHSA-gjgr-7834-rhxr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:synapse::::::::	before 1.106.0	Vulnerable	matrix-org

cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* Versions before 1.106.0 Vulnerable ·matrix-org

Remediation

Fix · CNA synapse (element-hq) Fixed in 1.106
Fix · GHSA-gjgr-7834-rhxr matrix-synapse (PyPI) Fixed in 1.106 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2024-37303
2026-10-03 Alias added: GHSA-gjgr-7834-rhxr

References

Patch 1

https://github.com/matrix-org/matrix-spec-proposals/pull/3916

Advisory 2

Other 2

TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
TI-2022-07650 Remote program execution with user interaction CVSS 3.1HIGH 8.8
TI-2026-19372 ESS Community Helm Chart has a weak server key generation method CVSS 4.0CRITICAL 9.2
TI-2024-24814 Synapse denial of service through media disk space consumption CVSS 3.1HIGH 7.5

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences