CVE-2023-45316: Reflected client side path traversal leading to CSRF in Playbooks

Vulnerability summary

CVE-2023-45316 is a high (CVSS 8.8) Cross-Site Request Forgery vulnerability in mattermost. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities.

Timeline

1. 12-12-2023
   PublishedVulnerability first disclosed.
2. 24-05-2025
   Last modifiedVulnerability information updated.

Description

Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.

• CWE-352Cross-Site Request ForgeryThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.