-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20251028000919-d3ed703dc833 | 8.0.0-20251028000919-d3ed703dc833 |
| github.com/mattermost/mattermost-server | go | >= 10.12.0, < 10.12.2 | 10.12.2 |
| github.com/mattermost/mattermost-server | go | >= 10.11.0, < 10.11.5 | 10.11.5 |
| github.com/mattermost/mattermost-server | go | >= 10.5.0, < 10.5.13 | 10.5.13 |
| github.com/mattermost/mattermost-server | go | >= 11.0.0, < 11.0.4 | 11.0.4 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patches reveals a critical vulnerability in the OAuth state token validation process within Mattermost. The commits consistently show a change in the server/channels/app/oauth.go file, specifically within the App.AuthorizeOAuthUser function. The vulnerability stemmed from the way the expectedTokenExtra was generated and validated. The original implementation concatenated the user's email, a specified action, and a cookie value using a simple colon delimiter (email:action:cookie). This method was insecure because it did not account for the possibility of the email address itself containing a colon. An attacker could register a user with an email like attacker@example.com:some_action, thereby injecting a colon into the state token. When AuthorizeOAuthUser later constructed its expectedTokenExtra string for comparison, this injected colon would break the expected email:action:cookie format, allowing the attacker to manipulate the validation logic and potentially take over another user's account. The patch rectifies this by introducing a strict parsing function, parseOAuthStateTokenExtra, which splits the token string and ensures it contains exactly three parts before comparing each part individually. This prevents the token confusion and secures the OAuth flow. Therefore, the App.AuthorizeOAuthUser function is identified as the vulnerable function.
App.AuthorizeOAuthUserserver/channels/app/oauth.go
Ongoing coverage of React2Shell