MEDIUM5.4
GHSA-59hf-mpf8-pqjh
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
Quick fix
GHSA-59hf-mpf8-pqjh — github.com/mattermost/mattermost/server/v8: upgrade to the fixed version with the command below.
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20240806094731-69a8b3df0f9fDetails
Mattermost does not strip `embeds` from `metadata` when broadcasting `posted` events.
This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message.
The advisory metadata references the appropriate go pseudo version available from pkg.go.dev
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/mattermost/mattermost/server/v8
Introduced in:
0Fixed in: 8.0.0-20240806094731-69a8b3df0f9fFix
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20240806094731-69a8b3df0f9fReferences
- https://nvd.nist.gov/vuln/detail/CVE-2024-47003[ADVISORY]
- https://github.com/mattermost/mattermost/pull/27763[WEB]
- https://github.com/mattermost/mattermost/commit/69a8b3df0f9fd3a7a5b792ec678b6191618d039b[WEB]
- https://github.com/c0rydoras/cves/tree/main/CVE-2024-47003[WEB]
- https://github.com/mattermost/mattermost[PACKAGE]
- https://mattermost.com/security-updates[WEB]