CVE-2024-1402: Denial of service in mattermost mobile apps and server via emoji reactions
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.
Other sources
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post. Fetching posts with huge amounts of reactions results in Uncontrolled Resource Consumption.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 9.1.5 - Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 9.2.4 - Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.1.8 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 9.3.0 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 9.2.4 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 9.1.5 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 8.1.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1402?
The severity of CVE-2024-1402 is classified as a denial-of-service vulnerability.
How do I fix CVE-2024-1402?
To fix CVE-2024-1402, upgrade Mattermost to version 9.1.5, 9.2.4, or 8.1.8 or newer.
Who is affected by CVE-2024-1402?
CVE-2024-1402 affects Mattermost Server versions before 9.1.5, 9.2.4, and 8.1.8.
What is the impact of CVE-2024-1402?
The impact of CVE-2024-1402 allows attackers to crash the mobile app by sending excessive non-existent custom emojis.
When was CVE-2024-1402 disclosed?
CVE-2024-1402 was disclosed in 2024, highlighting a critical issue in the Mattermost application.