PT-2024-32335 · Mattermost+1 · Mattermost+1
C0Rydoras
·
Published
2024-09-26
·
Updated
2024-11-05
·
CVE-2024-47003
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Mattermost versions 9.11.x through 9.11.0
Mattermost versions 9.5.x through 9.5.8
Description
The issue arises from the failure to validate that the message of a permalink post is a string, allowing an attacker to send a non-string value as the message and crash the frontend. Additionally, Mattermost does not strip
embeds from metadata when broadcasting posted events, which can be exploited to include arbitrary embeds in posts or trigger a client-side Denial of Service (DoS) by sending a permalink with a non-string message.Recommendations
For Mattermost versions 9.11.x through 9.11.0, update to a version that includes the fix for this issue.
For Mattermost versions 9.5.x through 9.5.8, update to a version that includes the fix for this issue.
As a temporary workaround, consider disabling the broadcasting of
posted events or restricting the use of permalink posts until a patch is available.
Restrict access to the metadata and embeds components to minimize the risk of exploitation.Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mattermost
Suse