CVE-2024-11358
📋 TL;DR
Mattermost Android mobile apps up to version 2.21.0 have a misconfigured file provider that allows local attackers to access sensitive files. This affects Android users of Mattermost mobile applications who haven't updated to the patched version. The vulnerability requires physical access to the device or malware with local execution capabilities.
💻 Affected Systems
- Mattermost Android Mobile App
📦 What is this software?
Mattermost Mobile by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access could extract sensitive Mattermost data, configuration files, or potentially other app data stored in accessible directories, leading to data breach or credential theft.
Likely Case
Malicious apps installed on the same device could access Mattermost files, potentially extracting chat history, authentication tokens, or configuration data.
If Mitigated
With proper mobile device management and app sandboxing, the impact is limited to the Mattermost app's own data storage, preventing cross-app data access.
🎯 Exploit Status
Exploitation requires local access to the Android device, either physically or through a malicious app with appropriate permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.22.0 and later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Open Google Play Store on Android device. 2. Search for Mattermost. 3. Update to version 2.22.0 or later. 4. Restart the Mattermost app after update.
🔧 Temporary Workarounds
Restrict App Installation
androidPrevent installation of untrusted apps that could exploit the vulnerability
Enable Android Verified Boot
androidEnsure device integrity and prevent unauthorized modifications
🧯 If You Can't Patch
- Implement mobile device management (MDM) to control app installations and permissions
- Educate users about risks of installing untrusted apps and physical device security
🔍 How to Verify
Check if Vulnerable:
Check Mattermost app version in Android Settings > Apps > Mattermost > App info. If version is 2.21.0 or lower, the device is vulnerable.Check Version:
Not applicable - check via Android Settings UIVerify Fix Applied:
After updating, verify the app version shows 2.22.0 or higher in Android Settings > Apps > Mattermost > App info.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from other apps to Mattermost directories
- Permission violations in Android system logs
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Not applicable for local file access vulnerability