CVE-2025-13352
📋 TL;DR
This vulnerability allows attackers to hijack Mattermost's GitHub reaction feature by exploiting improper plugin bot identity validation. Attackers can craft notification posts to make users add reactions to arbitrary GitHub objects without their consent. Affected systems include Mattermost versions 10.11.x up to 10.11.6 and Mattermost GitHub plugin versions up to 2.4.0.
💻 Affected Systems
- Mattermost
- Mattermost GitHub Plugin
📦 What is this software?
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate GitHub reactions on sensitive repositories, potentially causing confusion, miscommunication, or reputation damage by making users appear to endorse inappropriate content.
Likely Case
Attackers trick users into adding reactions to GitHub issues or pull requests they didn't intend to, potentially causing minor confusion or embarrassment.
If Mitigated
With proper access controls and monitoring, impact is limited to reaction manipulation only, with no data exposure or system compromise.
🎯 Exploit Status
Requires attacker to have ability to post crafted notifications in Mattermost channels where GitHub plugin is active.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Mattermost 10.11.7 or later, GitHub Plugin 2.4.1 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Update Mattermost to version 10.11.7 or later. 2. Update GitHub plugin to version 2.4.1 or later. 3. Restart Mattermost service.
🔧 Temporary Workarounds
Disable GitHub Plugin
allTemporarily disable the GitHub plugin integration to prevent exploitation.
mmctl plugin disable com.github.mattermost.plugin-github
Restrict Notification Permissions
allLimit which users can post notifications in channels with GitHub integration.
🧯 If You Can't Patch
- Disable GitHub plugin integration entirely.
- Implement strict access controls on who can post in channels with GitHub integration.
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version with 'mattermost version' command and verify GitHub plugin version in System Console > Plugins.Check Version:
mattermost versionVerify Fix Applied:
Confirm Mattermost version is 10.11.7+ and GitHub plugin is 2.4.1+ in System Console.📡 Detection & Monitoring
Log Indicators:
- Unusual reaction activity from GitHub plugin
- Multiple reaction events from single notification
Network Indicators:
- Unexpected GitHub API calls for reaction operations
SIEM Query:
source="mattermost" AND "github" AND "reaction" AND status="success" | stats count by user