Message-ID: <dd223fd5-0698-f77a-ed1e-62e5de4b06c3@rcesecurity.com>
Date: Wed, 18 Jan 2017 21:43:59 +0100
From: Julien Ahrens <info@...security.com>
To: fulldisclosure@...lists.org
Subject: [FD] [RCESEC-2016-012] Mattermost <= 3.5.1 "/error" Unauthenticated
 Reflected Cross-Site Scripting / Content Injection

RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product:        Mattermost
Vendor URL:     www.mattermost.org
Type:           Cross-Site Scripting [CWE-79]
Date found:     02/12/2016
Date published: 16/01/2017
CVSSv3 Score:   4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
CVE:            -


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
Mattermost v3.5.1
Mattermost v3.5.0
older versions may be affected too.


4. INTRODUCTION
===============
Mattermost is an open source Slack-alternative built for enterprise.
Thousands of companies use Mattermost for workplace messaging across
web, PC and phones with archiving, search, corporate directory
integration and connectivity to over 700 third party applications.
Available under MIT license in 11 languages Mattermost offers
peace-of-mind, value, control, and freedom from lock-in for
organizations around the world.


5. VULNERABILITY DETAILS
========================
The Mattermost "/error" page is vulnerable to an unauthenticated
reflected Cross-Site Scripting vulnerability when user-supplied input to
the HTTP GET parameter "link" is processed by the web application. Since
the application does not properly validate and sanitize this parameter,
it is possible to set the return link, which is part of the error page,
to a base64 encoded DATA URI. This could be used to execute arbitrary
JavaScript code in the context of an authenticated as well as
unauthenticated user.

There is one restriction which reduces the attack likelihood: Due to
JavaScript validations it is not possible to execute the payload by a
simple click on the return link, but instead it must be opened in a new
browser tab or window. However since an attacker does also have all
other text elements (HTTP GET parameters "title" and "linkmessage") of
the error page under control, it is possible to perform social
engineering attacks on the very same page.

The following Proof-of-Concept triggers this vulnerability by injecting
a base64-encoded data URI and a spoofed content text for the title and
link message:

https://localhost/error?title=Unknown%20Error&link=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=&linkmessage=http://mattermost.org&message=Something%20went%20wrong%20with%20the%20provided%20link,%20open%20it%20with%20a%20right%20click%20instead!

The payload is afterwards reflected within the response body:

<div class="error__container"><div class="error__icon"><i class="fa
fa-exclamation-triangle"></i></div><h2>Unknown
Error</h2><div><p>Something went wrong with the provided link, open it
with a right click instead!</p>
</div><a
href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">http://mattermost.org</a></div>


6. RISK
=======
To successfully exploit this vulnerability an authenticated or
unauthenticated user must be tricked into visiting a prepared link
provided by the attacker. Once on the "/error" page, the user must also
be tricked into opening the link in a new tab or window, which can be
accomplished by spoofing the other elements of the error page.

The vulnerability can be used to temporarily embed arbitrary script code
into the context of the Mattermost error page, which offers a wide range
of possible attacks such as redirecting the user to a malicious page or
attacking the browser and its plugins. Since session-relevant cookies
are protected with the HttpOnly flag, it is not possible to hijack sessions.


7. SOLUTION
===========
Update to Mattermost v3.6.0.


8. REPORT TIMELINE (DD/MM/YYYY)
===============================
02/12/2016: Discovery of the vulnerability
02/12/2016: Created support ticket #2231 with preset disclosure date
            set to 16/01/2017
12/12/2016: No response, sent out another notification
12/12/2016: Vendor confirms the vulnerability
03/01/2017: No further response, sent reminder about the disclosure date
16/01/2017: Vendor releases v3.6.0 which fixes this vulnerability
18/01/2017: Advisory released


9. REFERENCES
=============
-


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists