VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 1, 2024· Updated Aug 1, 2024

Malicious remote can claim that a user was synced from another remote

CVE-2024-41926

Description

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/mattermost/mattermost/server/v8Go
>= 9.5.0, < 9.5.79.5.7
github.com/mattermost/mattermost/server/v8Go
>= 9.9.0, < 9.9.19.9.1
github.com/mattermost/mattermost/server/v8Go
< 8.0.0-20240604093018-5114c3b7cdb88.0.0-20240604093018-5114c3b7cdb8
github.com/mattermost/mattermostGo
< 5.3.2-0.20240604093018-5114c3b7cdb85.3.2-0.20240604093018-5114c3b7cdb8

Affected products

1

Patches

1
5114c3b7cdb8

when sync'ing users make sure the user's remoteid matches the remote issuing the update (#27203)

https://github.com/mattermost/mattermostDoug LauderJun 4, 2024via ghsa
commit
2 files changed · +22 −1
  • server/platform/services/sharedchannel/sync_recv.go+15 −1 modified
    @@ -17,6 +17,10 @@ import (
 	"github.com/mattermost/mattermost/server/v8/platform/services/remotecluster"
 )
 
+var (
+	ErrRemoteIDMismatch = errors.New("remoteID mismatch")
+)
+
 func (scs *Service) onReceiveSyncMessage(msg model.RemoteClusterMsg, rc *model.RemoteCluster, response *remotecluster.Response) error {
 	if msg.Topic != TopicSync {
 		return fmt.Errorf("wrong topic, expected `%s`, got `%s`", TopicSync, msg.Topic)
@@ -167,7 +171,7 @@ func (scs *Service) processSyncMessage(c request.CTX, syncMsg *model.SyncMsg, rc
 
 func (scs *Service) upsertSyncUser(c request.CTX, user *model.User, channel *model.Channel, rc *model.RemoteCluster) (*model.User, error) {
 	var err error
-	if user.RemoteId == nil || *user.RemoteId == "" {
+	if SafeString(user.RemoteId) == "" {
 		user.RemoteId = model.NewString(rc.RemoteId)
 	}
 
@@ -185,6 +189,16 @@ func (scs *Service) upsertSyncUser(c request.CTX, user *model.User, channel *mod
 			return nil, err
 		}
 	} else {
+		// check if existing user belongs to the remote that issued the update
+		if SafeString(euser.RemoteId) != SafeString(user.RemoteId) {
+			scs.server.Log().Log(mlog.LvlSharedChannelServiceError, "RemoteID mismatch sync'ing user",
+				mlog.String("remote", rc.Name),
+				mlog.String("user_id", user.Id),
+				mlog.String("existing_user_remote_id", SafeString(euser.RemoteId)),
+				mlog.String("update_user_remote_id", SafeString(user.RemoteId)),
+			)
+			return nil, fmt.Errorf("error updating user: %w", ErrRemoteIDMismatch)
+		}
 		patch := &model.UserPatch{
 			Username:  &user.Username,
 			Nickname:  &user.Nickname,
  • server/platform/services/sharedchannel/util.go+7 −0 modified
    @@ -148,3 +148,10 @@ func reducePostsSliceInCache(posts []*model.Post, cache map[string]*model.Post)
 	}
 	return reduced
 }
+
+func SafeString(p *string) string {
+	if p == nil {
+		return ""
+	}
+	return *p
+}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.