CVE-2024-52815 – Synapse versions before 1.120.1 fail to properl... (How to Fix)

Q: What is the severity of CVE-2024-52815?

CVE-2024-52815 has a CVSS score of 5.3 (MEDIUM). Synapse versions before 1.120.1 fail to properly validate invites received over federation, allowing a malicious server to send specially crafted invites that disrupt the invited user's /sync functionality. This affects all Synapse homeservers that federate with other Matrix servers.

📋 TL;DR

Synapse versions before 1.120.1 fail to properly validate invites received over federation, allowing a malicious server to send specially crafted invites that disrupt the invited user's /sync functionality. This affects all Synapse homeservers that federate with other Matrix servers.

💻 Affected Systems

Products:

Synapse Matrix homeserver

Versions: All versions before 1.120.1

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects servers with federation enabled (default configuration).

📦 What is this software?

Synapse by Matrix

View all CVEs affecting Synapse →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Malicious server could persistently disrupt users' ability to sync messages and participate in rooms across federated Matrix network.

🟠

Likely Case

Targeted disruption of specific users' sync functionality by malicious federated servers.

🟢

If Mitigated

No impact if patched or if federation is disabled.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires control of a federated server to send malicious invites.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.120.1

Vendor Advisory: https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h

Restart Required: Yes

Instructions:

1. Update Synapse to version 1.120.1 or later using your package manager or pip. 2. Restart the Synapse service. 3. Verify the update was successful.

🔧 Temporary Workarounds

Disable Federation

all

Temporarily disable federation to prevent malicious invites from external servers.

Edit homeserver.yaml and set 'federation_domain_whitelist: []' or disable federation entirely

🧯 If You Can't Patch

Implement strict federation whitelisting to only allow trusted servers
Monitor for unusual invite patterns or sync failures in logs

🔍 How to Verify

Check if Vulnerable:

Check Synapse version with: python -m synapse.app.homeserver --version

Check Version:

python -m synapse.app.homeserver --version

Verify Fix Applied:

Verify version is 1.120.1 or higher and check logs for successful startup.

📡 Detection & Monitoring

Log Indicators:

Unusual invite patterns from federated servers
User sync failures or errors in logs

Network Indicators:

Abnormal invite traffic from specific federated servers

SIEM Query:

synapse AND (invite OR sync) AND (error OR failure)

📊 Metadata

CVE ID: CVE-2024-52815

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-20

Published: December 3, 2024

Last Updated: August 26, 2025

🔗 References

https://github.com/element-hq/synapse/security/advisories/GHSA-f3r3-h2mq-hx2h Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-52815, you might also want to check these: