Listen to this Post
This vulnerability affects Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, and 9.11.x <= 9.11.8. The flaw allows authenticated users to execute slash commands in archived channels despite access restrictions. Normally, archived channels should prevent all interactions, including command execution. However, due to improper validation, attackers can bypass this restriction and execute unauthorized commands, potentially leading to data leakage, privilege escalation, or remote code execution depending on the configured slash commands.
The vulnerability arises from insufficient server-side checks when processing slash commands (/command) in archived channels. The Mattermost server fails to verify the channel’s archived status before executing the command, allowing attackers to manipulate functionalities intended to be disabled. Exploitation requires an authenticated session, but low-privileged users can abuse this if they have access to the archived channel before it was disabled.
DailyCVE Form:
Platform: Mattermost
Version: 10.4.x <= 10.4.2
Vulnerability: Command Injection
Severity: Critical
Date: 03/27/2025
What Undercode Say:
Exploitation:
1. Attacker authenticates into Mattermost.
2. Locates an archived channel with accessible history.
- Sends a crafted slash command (e.g.,
/kick @user).
4. Server processes command despite channel being archived.
Protection:
1. Upgrade to Mattermost 10.4.3 or later.
- Disable slash commands in archived channels via
config.json:"RestrictArchivedChannels": true
3. Audit slash command permissions with:
mmctl command list --all
Detection Commands:
Check installed Mattermost version: curl -s http://localhost:8065/api/v4/config/client | grep version Log monitoring for suspicious commands: grep "slash_command" /opt/mattermost/logs/mattermost.log
Mitigation Script:
import requests
headers = {"Authorization": "Bearer YOUR_ACCESS_TOKEN"}
response = requests.patch("http://localhost:8065/api/v4/channels/archive",
json={"channel_id": "TARGET_CHANNEL_ID", "archive": false},
headers=headers)
print(response.status_code) 200 indicates success
Analytics:
- Attack Vector: Network (authenticated)
- CVSS:4.0 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Patch Release: Mattermost 10.4.3
- Workaround: Disable archived channel access via
System Console > Permissions.
References:
Reported By: https://nvd.nist.gov/vuln/detail/CVE-2025-25274
Extra Source Hub:
Undercode
