CVE-2024-29215
📋 TL;DR
This vulnerability allows authenticated Mattermost users to execute slash commands in channels they don't have access to by linking a playbook run to that channel. This affects Mattermost instances running vulnerable versions, potentially allowing unauthorized command execution within restricted channels.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could execute slash commands with elevated privileges in restricted channels, potentially accessing sensitive information or performing unauthorized actions.
Likely Case
Users accidentally or intentionally executing commands in channels they shouldn't have access to, potentially causing disruption or information leakage.
If Mitigated
Minimal impact with proper access controls and monitoring, limited to authorized command execution only.
🎯 Exploit Status
Exploitation requires authenticated user access, playbook permissions, and knowledge of the vulnerability. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Mattermost 9.5.4, 9.6.2, 9.7.2, or 8.1.13
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance and database. 2. Download the patched version from Mattermost downloads. 3. Stop the Mattermost service. 4. Replace the installation with the patched version. 5. Restart the Mattermost service. 6. Verify the version is updated.
🔧 Temporary Workarounds
Disable Playbooks feature
allTemporarily disable the Playbooks feature to prevent exploitation
Edit config.json: set "EnablePlaybooks" to false
Restart Mattermost service
Restrict playbook permissions
allLimit who can create and run playbooks to trusted users only
Navigate to System Console > Playbooks > Permissions
Adjust role permissions for playbook creation and execution
🧯 If You Can't Patch
- Implement strict access controls and monitor playbook activity
- Disable slash commands in sensitive channels or restrict their usage
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About Mattermost or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Verify version is 9.5.4+, 9.6.2+, 9.7.2+, or 8.1.13+ and test that users cannot execute slash commands in non-member channels via playbooks📡 Detection & Monitoring
Log Indicators:
- Unusual playbook creation/execution patterns
- Slash command execution from users not in channel members list
- Failed access attempts to restricted channels
Network Indicators:
- Increased API calls to playbook endpoints
- Unusual command execution patterns
SIEM Query:
source="mattermost" AND (event="playbook_run_created" OR event="slash_command_executed") AND user NOT IN channel_members