CVE-2024-5272
📋 TL;DR
This vulnerability in Mattermost allows guest users on channels with linked playbook runs to view all details of those runs when marked as finished. It affects organizations using Mattermost with guest accounts and playbook functionality, potentially exposing sensitive operational information.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Guest users could access sensitive playbook run details containing confidential operational data, internal processes, or security procedures.
Likely Case
Guest users unintentionally gain access to playbook run details they shouldn't see, potentially exposing internal workflows or sensitive information.
If Mitigated
Limited exposure with proper guest account controls and monitoring, but still represents an information disclosure risk.
🎯 Exploit Status
Requires guest account access to a channel with a linked playbook run that has been marked as finished.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.5.4, 9.6.2, 8.1.13 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Download the patched version from Mattermost releases. 3. Stop Mattermost service. 4. Apply the update. 5. Restart Mattermost service. 6. Verify version is updated.
🔧 Temporary Workarounds
Disable guest accounts
allTemporarily disable guest account functionality to prevent exploitation
Edit config.json: set 'EnableGuestAccounts' to false
Restrict playbook run linking
allPrevent linking playbook runs to channels with guest users
🧯 If You Can't Patch
- Disable guest account functionality in Mattermost configuration
- Implement strict access controls and monitoring for channels with linked playbook runs
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Verify version is 9.5.4+, 9.6.2+, or 8.1.13+ and test that guest users cannot access playbook run details📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to playbook run endpoints by guest users
- Webhook event logs showing 'custom_playbooks_playbook_run_updated' access
Network Indicators:
- Increased API calls to playbook endpoints from guest accounts
SIEM Query:
source='mattermost' AND (event='custom_playbooks_playbook_run_updated' OR endpoint LIKE '%playbook%') AND user_role='guest'