Horizon Alert
Summary of the vulnerability and why it matters
A critical security vulnerability has been identified in Mattermost, a collaboration platform, related to how it handles user authentication through OpenID Connect. This issue could allow an attacker to take over user accounts under specific, though not uncommon, system configurations. The main concern is confirming if our environment is exposed and verifying its relevance.
- Authentication flaw allows account takeover.
- Critical vulnerability in collaboration platform.
- Confirm relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker could target an organization using Mattermost, leveraging its OpenID Connect authentication. By creating a user in the connected SSO system and having access to Mattermost with team creation privileges, the attacker could manipulate the authentication process. This manipulation, combined with specific Mattermost settings, allows them to impersonate another user and gain unauthorized access to their account.
- Attacker needs limited Mattermost access.
- Trigger involves OAuth completion flow.
- Risk is full account takeover.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an authenticated attacker with team creation privileges to take over another user's account when email verification is disabled and OpenID Connect authentication is enabled. The attacker could manipulate authentication data during the OAuth completion flow to impersonate a user, provided they control two users in the Single Sign-On system, with one of them never having logged into Mattermost before.
- User accounts and their associated data.
- Through authentication data manipulation.
- Account takeover and unauthorized access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Mattermost platform's security team, likely working with infrastructure or application owners, should prioritize identifying all instances of the affected Mattermost Server. The immediate first step is to confirm if OAuth and OpenID Connect are enabled and if email verification is disabled on these instances, as these are prerequisites for exploitation. Once identified and confirmed as active, the team should assess business criticality and plan remediation based on the potential for account takeover.
- Accountable teams: Mattermost platform and security.
- Verify configuration: OAuth, OpenID Connect, email verification status.
- Action: Plan risk-based remediation, coordinate with vendors.
