Mattermost 3.5.0 / 3.5.1 Cross Site Scripting

`RCE Security Advisory  
https://www.rcesecurity.com  
  
  
1. ADVISORY INFORMATION  
=======================  
Product: Mattermost  
Vendor URL: www.mattermost.org  
Type: Cross-site Scripting [CWE-79]  
Date found: 02/12/2016  
Date published: 16/01/2017  
CVSSv3 Score: 4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)  
CVE: -  
  
  
2. CREDITS  
==========  
This vulnerability was discovered and researched by Julien Ahrens from  
RCE Security.  
  
  
3. VERSIONS AFFECTED  
====================  
Mattermost v3.5.1  
Mattermost v3.5.0  
older versions may be affected too.  
  
  
4. INTRODUCTION  
===============  
Mattermost is an open source Slack-alternative built for enterprise.  
Thousands of companies use Mattermost for workplace messaging across  
web, PC and phones with archiving, search, corporate directory  
integration and connectivity to over 700 third party applications.  
Available under MIT license in 11 languages Mattermost offers  
peace-of-mind, value, control, and freedom from lock-in for  
organizations around the world.  
  
  
5. VULNERABILITY DETAILS  
========================  
The Mattermost "/error" page is vulnerable to an unauthenticated  
reflected Cross-Site Scripting vulnerability when user-supplied input to  
the HTTP GET parameter "link" is processed by the web application. Since  
the application does not properly validate and sanitize this parameter,  
it is possible to set the return link, which is part of the error page,  
to a base64 encoded DATA URI. This could be used to execute arbitrary  
JavaScript code in the context of an authenticated as well as  
unauthenticated user.  
  
There is one restriction which reduces the attack likelihood: Due to  
JavaScript validations it is not possible to execute the payload by a  
simple click on the return link, but instead it must be opened in a new  
browser tab or window. However since an attacker does also have all  
other text elements (HTTP GET parameters "title" and "linkmessage") of  
the error page under control, it is possible to perform social  
engineering attacks on the very same page.  
  
The following Proof-of-Concept triggers this vulnerability by injecting  
a base64-encoded data URI and a spoofed content text for the title and  
link message:  
  
https://localhost/error?title=Unknown%20Error&link=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=&linkmessage=http://mattermost.org&message=Something%20went%20wrong%20with%20the%20provided%20link,%20open%20it%20with%20a%20right%20click%20instead!  
  
The payload is afterwards reflected within the response body:  
  
<div class="error__container"><div class="error__icon"><i class="fa  
fa-exclamation-triangle"></i></div><h2>Unknown  
Error</h2><div><p>Something went wrong with the provided link, open it  
with a right click instead!</p>  
</div><a  
href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">http://mattermost.org</a></div>  
  
  
6. RISK  
=======  
To successfully exploit this vulnerability an authenticated or  
unauthenticated user must be tricked into visiting a prepared link  
provided by the attacker. Once on the "/error" page, the user must also  
be tricked into opening the link in a new tab or window, which can be  
accomplished by spoofing the other elements of the error page.  
  
The vulnerability can be used to temporarily embed arbitrary script code  
into the context of the Mattermost error page, which offers a wide range  
of possible attacks such as redirecting the user to a malicious page or  
attacking the browser and its plugins. Since session-relevant cookies  
are protected with the HttpOnly flag, it is not possible to hijack sessions.  
  
  
7. SOLUTION  
===========  
Update to Mattermost v3.6.0.  
  
  
8. REPORT TIMELINE (DD/MM/YYYY)  
===============================  
02/12/2016: Discovery of the vulnerability  
02/12/2016: Created support ticket #2231 with preset disclosure date  
set to 16/01/2017  
12/12/2016: No response, sent out another notification  
12/12/2016: Vendor confirms the vulnerability  
03/01/2017: No further response, sent reminder about the disclosure date  
16/01/2017: Vendor releases v3.6.0 which fixes this vulnerability  
18/01/2017: Advisory released  
  
  
9. REFERENCES  
=============  
-  
  
`