CVE-2022-31052
URL previews can crash Synapse media repositories or Synapse monoliths
Em resumo
Visualizações de URLs no Synapse podem derrubar o servidor ao processar certas páginas da web devido à recursão ilimitada. Isso afeta servidores de chat que têm a visualização de URLs ativada, e pode ser explorada por usuários maliciosos ou URLs remotas.
Detalhe técnico
Recursão não limitada no processamento de visualização de URLs (CWE-674) permite que usuários locais autenticados ou usuários remotos (via requisições automáticas de clientes) esgotem espaço de pilha no Synapse, causando negação de serviço por travamento ou erro. A vulnerabilidade requer `url_preview_enabled: true` na configuração e afeta versões anteriores à 1.61.1.
Resumo gerado e traduzido por IA a partir da descrição oficial.
Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false` set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`. Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
matrix-org · synapseQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EARKKJZ2W7WUITFDT4EG4NVATFYJQHF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGSDQ4YAITCUACAB7SXQZDJIU3IQ4CJD/https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url