CVE-2024-34152
📋 TL;DR
This vulnerability allows guest users in Mattermost to access metadata of public playbook runs linked to channels they are guests in, bypassing intended access controls. It affects Mattermost versions 9.5.x up to 9.5.3, 9.6.x up to 9.6.1, and 8.1.x up to 8.1.12. The issue occurs when guests send specific GraphQL queries to the server.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Guest users could access sensitive metadata about playbook runs, potentially exposing operational details, timelines, or other confidential information about team workflows and processes.
Likely Case
Guests gain unauthorized visibility into playbook run metadata, which could reveal information about team activities, project statuses, or operational procedures they shouldn't access.
If Mitigated
With proper network segmentation and guest user restrictions, impact is limited to metadata exposure within already accessible channels.
🎯 Exploit Status
Exploitation requires guest user access and knowledge of GraphQL queries. No authentication bypass needed beyond guest privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.5.4, 9.6.2, 8.1.13 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Download the patched version from Mattermost downloads. 3. Stop the Mattermost service. 4. Replace the installation with the patched version. 5. Restart the Mattermost service. 6. Verify the version is updated.
🔧 Temporary Workarounds
Disable Guest Accounts
allTemporarily disable guest user functionality to prevent exploitation
Update Mattermost config.json: "EnableGuestAccounts": false
Restrict Playbook Access
allLimit playbook functionality to specific teams or disable it entirely
System Console > Playbooks > Enable Playbooks: false
🧯 If You Can't Patch
- Implement strict network access controls to limit guest user connections
- Monitor GraphQL query logs for RHSRuns queries from guest users
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About Mattermost. If version matches affected ranges and guest/playbook features are enabled, system is vulnerable.Check Version:
From Mattermost CLI: mattermost version or check System Console > AboutVerify Fix Applied:
After patching, verify version is 9.5.4+, 9.6.2+, or 8.1.13+. Test with guest account attempting RHSRuns GraphQL query.📡 Detection & Monitoring
Log Indicators:
- GraphQL queries containing 'RHSRuns' from guest users
- Unauthorized access attempts to playbook metadata
Network Indicators:
- GraphQL API requests to /api/v4/graphql with RHSRuns operation from guest IPs
SIEM Query:
source="mattermost" AND (query="RHSRuns" OR operation="RHSRuns") AND user_role="guest"