Summary
Mattermost, Inc. heeft kwetsbaarheden verholpen in Mattermost versies 10.11.x, 11.7.x en 11.8.x, inclusief de GitLab plugin tot versie 11.8.
Details
Interpretaties
De kwetsbaarheden betreffen meerdere aspecten van de Mattermost software, waaronder onjuiste validatie van WebSocket command velden, onjuiste reconciliatie van SchemeAdmin flags, en onvoldoende verificatie van kanaaleigendom bij ABAC policy unassign endpoints. Hierdoor kunnen geauthenticeerde gebruikers onder andere denial-of-service veroorzaken door het laten crashen van plugin processen, administratieve privileges behouden na demotie, en ongeautoriseerde wijzigingen aanbrengen in toegangscontrolebeleid en board-rollen. Verder kunnen guest gebruikers via speciaal vervaardigde boardarchiefbestanden hun privileges escaleren naar Board Admin. OAuth applicaties kunnen tokens en autorisaties van andere integraties intrekken door onvoldoende restricties op deaccountbeheer endpoints. Ook is het mogelijk om voltooide playbook runs te wijzigen door het ontbreken van run-state validatie. Daarnaast kunnen gebruikers zonder voldoende leesrechten boards koppelen aan kanalen, waardoor lidmaatschappen van private kanalen worden blootgesteld. Channel administrators kunnen hun permissies verhogen via manipulatie van de channel member roles API.
De GitLab plugin vertoont een kwetsbaarheid waardoor bots berichten met willekeurige URLs kunnen injecteren in kanalen zonder toegangsrechten. Thread membership records worden niet verwijderd bij vertrek uit een team, wat toegang tot private thread content kan geven bij herintreding. Ten slotte is er een kwetsbaarheid in de server-side validatie van BoardMember.Scheme* velden, waardoor privilege escalatie mogelijk is door het toekennen van board admin rechten aan willekeurige gebruikers, en een permissiecontrole ontbreekt bij het relinken van boards aan kanalen via de batch endpoint.
Oplossingen
Mattermost, Inc. heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de genoemde versies van Mattermost en de GitLab plugin. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 12
-
High 8.3
Insufficient server-side validation of board member role fields permits privilege escalation
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users…
-
Medium 6.5
Boards plugin panics on WebSocket command with non-string field types
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_T…
-
Medium 6.5
Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary c…
-
Medium 6.3
Boards plugin retains Board Admin rights for users demoted to System Guest
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the …
-
Medium 6.3
Channel member roles accept out-of-scope roles
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. …
-
Medium 4.3
Board channel linking without read channel permission validation
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the sa…
-
Medium 4.2
Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (att…
-
Low 3.9
Insufficient validation of guest board admin privileges on archive import
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive f…
-
Low 3.9
_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured …
-
Low 3.5
Missing run-state validation on finished playbook runs
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on co…
-
Low 3.5
Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thr…
-
Low 2.7
Delegated OAuth tokens could revoke unrelated OAuth application authorizations
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's a…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://mattermost.com/security-updates/