CVE-2024-47003: DoS via non-string message using permalink embed
Mattermost does not strip embeds from metadata when broadcasting posted events.
This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a client Side Denial of Service (DoS) by sending a permalink with a non-string message.
The advisory metadata references the appropriate go pseudo version available from pkg.go.dev
Other sources
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47003?
CVE-2024-47003 has a moderate severity rating due to the potential for arbitrary content embedding in posts.
How do I fix CVE-2024-47003?
To fix CVE-2024-47003, upgrade to Mattermost Server version 8.0.0-20240806094731-69a8b3df0f9f or later.
Which versions of Mattermost are affected by CVE-2024-47003?
CVE-2024-47003 affects Mattermost Server versions 9.5.0 to 9.5.9 and version 9.11.0.
What type of attack can CVE-2024-47003 enable?
CVE-2024-47003 can enable users to create permalinks with customizable content through arbitrary embeds in posts.
Can CVE-2024-47003 be exploited through websockets?
Yes, CVE-2024-47003 can be exploited via websockets, allowing the broadcast of malicious embeds.