Listen to this Post
This vulnerability exists in the Mattermost server’s handling of post action integrations, specifically the `/share-issue-publicly` slash command intended for the Jira plugin. The system fails to authenticate the origin of post action payloads. When a user creates a post with a message attachment button, the associated action (e.g., "integration":{"url":...,"context":{}}) is not cryptographically signed or validated to confirm it was generated by the legitimate Jira plugin. A malicious user can craft a post with a deceptive button that appears legitimate but contains a manipulated action payload. This payload points the `/share-issue-publicly` command to an attacker-controlled server instead of the legitimate Jira instance. When a victim user clicks the button, their Mattermost session credentials are sent via the request to the attacker’s server, allowing the attacker to then use those credentials to access and exfiltrate Jira tickets visible to the victim through the genuine `/share-issue-publicly` endpoint.
Platform: Mattermost
Version: 10.11.0-10.11.7
Vulnerability: Insufficient Origin Verification
Severity: Moderate
date: 2024-12-24
Prediction: 2024-12-27
What Undercode Say:
curl -s https://raw.githubusercontent.com/mattermost/<repo>/<branch>/CHANGELOG.md | grep -A5 -B5 "share-issue-publicly" grep -r "integration.context" --include=".go" mattermost-server/ docker run --rm -it mattermost/mattermost-enterprise-edition:10.11.7 version
How Exploit:
1. Attacker crafts post with malicious action button.
2. Payload points `/share-issue-publicly` to rogue server.
3. Victim clicks button, sending authenticated request.
4. Attacker captures session, fetches Jira tickets.
Protection from this CVE
Upgrade to patched versions: 10.11.8, 10.12.4, 11.0.6, 11.1.1, or specific 8.x commit. Implement network controls to restrict outbound calls from Mattermost server to only authorized Jira instances.
Impact:
Unauthorized Jira ticket disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
