Listen to this Post
The vulnerability exists in the OAuth2 team invitation flow. When a user joins a team via an OAuth2 provider (like GitLab), the server creates an initial “state” parameter linking the invite token and the team ID. The flaw is that the endpoint handling the OAuth2 callback (/oauth/authorize) does not properly re-validate that the user being authenticated is authorized for the specific team identified in the state parameter. An attacker can intercept a valid OAuth2 state parameter from any initial team join attempt. By manipulating this state parameter to replace the `teamId` with the identifier of a different, restricted team, and then proceeding through the OAuth2 flow, the server will erroneously add the attacker’s account to the target team. This bypasses all team membership and invite link restrictions because the validation only checks the integrity of the state signature, not the user’s permissions for the team ID contained within it.
Platform: Mattermost
Version: <=10.11.1, 10.10.2, 10.5.10
Vulnerability: Authorization Bypass
Severity: Critical
date: 2025-02-17
Prediction: 2025-03-10
What Undercode Say:
curl -X POST 'http://<target>/oauth/authorize' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'response_type=code&client_id=<client_id>&redirect_uri=<redirect_uri>&state=<tampered_state>'
import requests
Craft a malicious state parameter
tampered_state = sign_state({"teamId": "TARGET_TEAM_ID", "inviteId": "KNOWN_INVITE_ID"})
oauth_url = f"http://<mattermost>/oauth/authorize?response_type=code&client_id=<id>&redirect_uri=<uri>&state={tampered_state}"
Follow the OAuth flow to gain unauthorized access
How Exploit:
Intercept OAuth state.
Replace teamId value.
Complete OAuth flow.
Gain team access.
Protection from this CVE:
Upgrade to 10.11.2.
Upgrade to 10.10.3.
Upgrade to 10.5.11.
Impact:
Unauthorized team access.
Data breach.
Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
