-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description states that Mattermost Playbooks fails to properly validate props used by the RetrospectivePost custom post type. The commit 4c823090e281cb9c0d5c17ee2e5db275117540d1 in mattermost/mattermost-plugin-playbooks directly addresses this.
In the file webapp/src/components/retrospective_post.tsx, the RetrospectivePost component was modified. The patch shows that the lines:
- const metricsConfigs: Array<Metric> = JSON.parse(props.post.props.metricsConfigs);
- const metricsData: Array<RunMetricData> = JSON.parse(props.post.props.metricsData);
were replaced with lines that use safeJSONParse and additional type validation (isArrayOf, isMetric, isMetricData):
+ const parsedMetricsConfigs = safeJSONParse<unknown>(props.post.props?.metricsConfigs);
+ const parsedMetricsData = safeJSONParse<unknown>(props.post.props?.metricsData);
+
+ const metricsConfigs: Array<Metric> = isArrayOf(parsedMetricsConfigs, isMetric) ? parsedMetricsConfigs : [];
+ const metricsData: Array<RunMetricData> = isArrayOf(parsedMetricsData, isMetricData) ? parsedMetricsData : [];
This change clearly indicates that the RetrospectivePost function was previously vulnerable due to the direct and unsafe parsing of props.post.props.metricsConfigs and props.post.props.metricsData. The lack of validation before parsing is the root cause, allowing maliciously crafted props to cause a DoS. The other modified file, webapp/src/utils.ts, introduces helper functions for the fix (safeJSONParse, isArrayOf, isMetric, isMetricData) and are not vulnerable themselves but part of the mitigation. The commit in the mattermost/mattermost repository (2b5275d87136f07e016c8eca09a2f004b31afc8a) is just an update to the plugin version in the Makefile and does not contain code changes relevant to the vulnerability itself.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-plugin-playbooks | go | >= 2.0.0, < 2.1.1 | |
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250218121836-2b5275d87136 | 8.0.0-20250218121836-2b5275d87136 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.4.0, < 10.4.3 | |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.5.0, < 10.5.1 | |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.11.0, < 9.11.11 | |
| github.com/mattermost/mattermost-plugin-playbooks | go | < 1.41.0 | 1.41.0 |
GoGoKEV Misses 88% of Exploited CVEs- Get the report