CVE-2022-1332: Mattermost Server API Permissions Bypass
Summary
CVE-2022-1332: One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server lo... Affects mattermost across 4 version ranges.
>= 5.37.0, < 5.37.9
>= 6.2.0, < 6.2.5
>= 6.3.0, < 6.3.5
>= 6.4.0, < 6.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-1332 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost is an open-source messaging platform designed for team collaboration. It provides features such as instant messaging, file sharing, and integrations with other tools. The Mattermost Server API allows users to interact with the platform programmatically. However, in versions 6.4.1 and earlier, a vulnerability exists that allows authenticated members with restricted custom admin roles to bypass permissions and access sensitive information.
Vulnerability Detail
The vulnerability in Mattermost Server API version 6.4.1 and earlier arises from a failure to properly protect permissions. This flaw enables users with restricted custom admin roles to bypass the intended restrictions and gain unauthorized access to server logs and the server config.json file. By exploiting this vulnerability, an attacker could potentially obtain sensitive information, leading to further compromise of the Mattermost instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.37.0, < 5.37.95.37.9 -
>= 6.2.0, < 6.2.56.2.5 -
>= 6.3.0, < 6.3.56.3.5 -
>= 6.4.0, < 6.4.26.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the server logs and config.json file by modifying the file permissions. By setting appropriate access controls, the impact of the vulnerability can be mitigated. However, this is not a permanent solution, and it is still crucial to update to the latest version of Mattermost to fully address the vulnerability.
Conclusion
The vulnerability in Mattermost Server API versions 6.4.1 and earlier allows users with restricted custom admin roles to bypass permissions and access sensitive information. To mitigate this issue, it is recommended to update Mattermost to version 6.4.2 or later. Additionally, restricting access to the server logs and config.json file can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mattermost →
FAQ
Mattermost is an open-source messaging platform designed for team collaboration. It provides features such as instant messaging, file sharing, and integrations with other tools.
This vulnerability allows authenticated members with restricted custom admin roles to bypass permissions and access server logs and the server config.json file. It could potentially lead to unauthorized access to sensitive information and further compromise of the Mattermost instance.
Mattermost versions 6.4.1 and earlier are affected by this vulnerability.
To fix this vulnerability, it is recommended to update Mattermost to version 6.4.2 or later. This update includes the necessary fixes to properly protect permissions in the affected API.
As a temporary workaround, users can restrict access to the server logs and config.json file by modifying the file permissions. However, it is still crucial to update to the latest version of Mattermost to fully address the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mattermost.
