Denial of Service in Mattermost via Bulk Reactions

Executive Summary

Mattermost versions between 11.7.x and 11.10.x (specifically <= 11.7.10, <= 11.8.5, <= 11.9.1, <= 11.10.1) have a flaw in the bulk reactions endpoint. The system fails to restrict the size of the post ID array sent in requests. This allows authenticated users to send abnormally large arrays, causing excessive database load.

Useful 0 Not Useful 0

Detection Guidance

Monitor API logs for excessive requests to the /api/v4/posts/ids/reactions endpoint. Check for unusually large post ID arrays in requests. Inspect database load metrics for sudden spikes during authenticated user sessions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials could exploit this to overload the database server, leading to degraded performance or temporary unavailability of the Mattermost instance. This disrupts normal operations and may cause service outages for all users.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows excessive database load via crafted requests, which could lead to denial-of-service conditions. This may impact compliance by disrupting availability of systems handling sensitive data, potentially violating GDPR's availability principle or HIPAA's access controls if critical healthcare data becomes inaccessible.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mattermost to a patched version (11.9.2 or later, 11.8.6 or later, 11.7.11 or later, 11.10.2 or later). Apply rate limiting to the vulnerable endpoint. Review and restrict user permissions to prevent abuse.

Useful 0 Not Useful 0