Executive Summary

This vulnerability exists in Mattermost versions 11.5.x up to 11.5.1 and 10.11.x up to 10.11.13. It occurs because the software fails to validate the Host header when constructing response URLs for custom slash commands.

An authenticated attacker can exploit this by sending a spoofed Host header, which causes the slash command responses to be redirected to a server controlled by the attacker.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker with valid authentication can redirect responses from slash commands to an attacker-controlled server.

This could potentially lead to information leakage or manipulation of the responses intended for legitimate users, although the CVSS score indicates a low to medium severity with limited impact on confidentiality and availability but some impact on integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Mattermost to a version later than 11.5.1 or 10.11.13 where the Host header validation issue has been fixed.

Additionally, monitor the official Mattermost Security Updates page for any patches or further guidance.

Useful 0 Not Useful 0