Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow

Vulnerability

Overview

The Mattermost Confluence plugin versions prior to 1.7.0 contain a stored cross-site scripting (XSS) vulnerability in its HTML template rendering. The plugin fails to properly escape user-controlled display names during the rendering of OAuth2 connection links. This allows an authenticated Confluence user with a maliciously crafted display name to inject arbitrary JavaScript code that will be executed in the browser of any Mattermost user who visits a specially crafted link. [1]

Exploitation

Prerequisites

An attacker must have an authenticated Confluence account and set their display name to include a JavaScript payload. The attacker then sends a specially crafted OAuth2 connection link to a Mattermost user. When the victim clicks the link, the plugin renders the attacker's display name without sanitization, causing the injected script to execute in the victim's browser. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, data exfiltration, or further malicious actions within the Mattermost or Confluence environment. [1]

Mitigation

The vulnerability is fixed in the Mattermost Confluence plugin version 1.7.0. Users should upgrade to this version or later to mitigate the risk. [1]