Doyensec

An issue exists where the software fails to verify the integrity of the SAML RelayState POST parameter. This allows an authenticated SAML user to join any team, including those restricted to invites, by forging the `team id` or `invite id` fields within the RelayState.

Improper handling of case sensitivity in the identity zone authorization check within the Identity Zone Endpoint allows a remote authenticated attacker with `zones.write` authority to bypass restrictions protecting the privileged `uaa` (system) identity zone. By using a non-lowercase zone identifier (e.g., `UAA`) in the request path and body, the attacker can exploit a discrepancy where the authorization layer performs a case-sensitive comparison, but the MySQL persistence layer resolves identifiers case-insensitively under its default collation. This allows the attacker to overwrite the system zone's JWT signing key with controlled material and forge JSON Web Tokens (JWTs) claiming admin client and administrator scopes, leading to a full compromise of UAA and trusting Cloud Foundry deployments. This issue specifically affects deployments using MySQL with default collation.

The application fails to properly validate the SSO authentication callback origin. This allows an attacker who controls a malicious Mattermost server to steal user credentials for a legitimate Mattermost server by relaying the SSO code exchange flow through the mobile application.

The Mattermost Desktop App does not properly remove sensitive information from its logs or clear data when a server is deleted. This could allow an attacker who has access to a user's system to obtain potentially sensitive information by reading the application logs.

An authenticated user can access files and subscribe to blocks in Boards without proper permission validation. This allows access to files from other boards and subscription to blocks from boards the user should not have access to.

A flaw exists in Mattermost where the system does not properly verify a user’s permission to join a team using an invite token. This allows an attacker to join any team on a Mattermost server, bypassing restrictions through manipulation of the `RelayState` parameter. The issue involves improper validation of user permissions when joining a team via an invite token.

The software does not employ constant-time comparison for sensitive string comparisons, creating a timing oracle. This allows attackers to exploit timing differences during response time analysis to perform byte-by-byte brute force attacks on Cloud API keys and OAuth client secrets.

The Mattermost software has an issue where user permissions are not properly verified when joining a team using an invite token. This is due to manipulation of the OAuth state parameter. An attacker can bypass team membership restrictions and join any team on a Mattermost server without authorization.

The Mattermost Desktop App does not properly manage modals. This impacts users connecting to servers that utilize basic authentication, potentially preventing access. An attacker can provide a malicious server to a user, and upon configuration, force a modal popup that cannot be closed, effectively denying use of the Desktop App.

The Mattermost Mobile Apps do not properly validate Single Sign-On (SSO) redirect tokens to ensure they come from a trusted server. This allows a malicious Mattermost instance or an attacker positioned on the network path to steal user session credentials through specially crafted token-in-URL responses.

The Mattermost Desktop App does not properly validate URLs originating from outside the configured Mattermost servers. This allows a malicious server to cause the application to crash by sending a specially crafted URL to a user.

The software does not properly limit the dictionary size when processing RAR files. An attacker can exploit this by providing a specially crafted RAR file with a large dictionary size, leading to a Denial of Service due to an Out Of Memory crash.

The software does not properly implement Cross-Site Request Forgery (CSRF) protection on the Calls widget page. This allows an authenticated attacker to initiate calls and inject messages into channels or direct messages through a malicious webpage or crafted link. CSRF is a type of web security issue where an attacker can trick a user's browser into performing unwanted actions on a trusted site when the user is authenticated.

Mattermost fails to validate the `redirect to` parameter, potentially allowing an attacker to craft a malicious link. Upon a user authenticating with their SAML provider, their cookies could be posted to a URL controlled by the attacker.

The issue allows an attacker to reuse the MFA code within ~30 seconds due to a failure to protect the MFA code against replay attacks.

The issue allows an attacker to generate a large response and cause an amplified GraphQL response which could cause the application to crash by sending a specially crafted request to Playbooks. This is due to the failure to prevent detailed error messages from being displayed in Playbooks.

The issue is related to a failure in sanitizing user inputs in the frontend, which are used for redirection. This leads to a one-click client-side path traversal, resulting in Cross-Site Request Forgery (CSRF) in Playbooks.

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.8 Description: The issue arises from Mattermost's failure to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, potentially allowing an attacker to cause a server-side request forgery (SSRF) if Mattermost is deployed in Oracle Cloud or Alibaba. This could enable an attacker to remotely manipulate server requests. Recommendations: For Mattermost versions 9.5.x through 9.5.8, upgrade Mattermost immediately to mitigate the risk of server-side request forgery. As a temporary workaround, consider restricting access to the metadata endpoints of Oracle Cloud and Alibaba to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop App versions <=5.8.0 Description: The Mattermost Desktop App fails to sufficiently configure Electron Fuses, allowing an attacker to gather Chromium cookies or abuse other misconfigurations via remote or local access. This issue can be exploited locally. Recommendations: For Mattermost Desktop App versions <=5.8.0, upgrade the affected component to a version that properly configures Electron Fuses to prevent exploitation. As a temporary workaround, consider restricting access to sensitive data stored in Chromium cookies until the issue is resolved.

The issue concerns a flaw in the screen capture functionality of the Mattermost Desktop App, allowing an attacker to silently capture high-quality screenshots via JavaScript APIs.