Listen to this Post
The vulnerability exists within the Mattermost GitHub plugin’s reaction forwarding feature. When a user adds an emoji reaction to a post from the GitHub bot, the plugin forwards that reaction to the linked GitHub issue or pull request. The flaw is that the plugin fails to properly validate that the post being reacted to is a legitimate, untampered notification created by the authentic GitHub bot. An attacker with permissions to create posts in a Mattermost channel can craft a malicious post that mimics the bot’s appearance and contains embedded metadata pointing to an arbitrary GitHub repository, issue, or comment. When another user sees this fake notification and adds a reaction, the plugin blindly trusts the metadata in the post and forwards the user’s reaction to the attacker-specified GitHub target, hijacking the user’s GitHub credentials to perform an unauthorized action.
Platform: Mattermost GitHub Plugin
Version: <=10.11.6, <=2.4.0
Vulnerability: Identity Validation Bypass
Severity: Low
date: 2025-12-17
Prediction: 2025-12-17
What Undercode Say:
Check installed plugin version
grep -A2 -B2 “github” mattermost/config/plugin.json
Example crafted post metadata (conceptual)
{“post”:{“metadata”:{“github”:{“repository”:”attacker/repo”,”issue_number”:123}}}}
How Exploit:
1. Attacker forges bot post.
2. Embeds malicious GitHub target.
3. User reacts innocently.
4. Reaction injected to attacker’s target.
Protection from this CVE
Update to plugin version 2.4.1.
Update Mattermost to 10.11.7+.
Implement bot message verification.
Impact:
Unauthorized GitHub reactions.
Potential reputation misuse.
No code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
