GitHub Advisoryadvisory · Go

GHSA-59hf-mpf8-pqjh Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

MEDIUM Published 2024-09-26 Modified 2024-09-27 Official page ↗
Aliases
CVE-2024-47003
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-400
Reviewed
2024-09-27

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20240806094731-69a8b3df0f9f → fixed in 8.0.0-20240806094731-69a8b3df0f9f

Description

Mattermost does not strip `embeds` from `metadata` when broadcasting `posted` events. This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message. The advisory metadata references the appropriate go pseudo version available from pkg.go.dev

Related

Alias · CVE (1)

  • CVE-2024-47003 Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References