Executive brief
Mattermost Desktop is a desktop communication application used for team collaboration and messaging. Versions 5.7.0 and earlier fail to properly validate external URLs before opening them, allowing an attacker to trick users into executing arbitrary programs by crafting malicious links. An attacker could gain full control of a victim's computer if the exploit is successful.
Technical details
The vulnerability is a permissions bypass (CWE-693) in URL handling, specifically affecting custom URI scheme processing. Affected versions do not correctly prompt the user for permission before opening external URLs, allowing attackers to silently redirect users to untrusted resources and trigger arbitrary code execution through custom URI schemes. The attack requires network access and user interaction (clicking a malicious link), but no authentication. The fix was implemented in version 5.8.0, which adds proper permission prompts before processing redirects to untrusted URLs.
Affected products
- Mattermost Desktop <=5.7.0
Timeline
- 2024-06-14: disclosed: GHSA and CVE published
- 2024-05-08: patched: Fix committed in version 5.8.0