Mattermost Public Bug Bounty Engagement

Description

Mattermost is the leading collaboration platform for mission-critical work. We serve national security, government, and critical infrastructure enterprises, from the U.S. Department of Defense, to global tech giants, to utilities, banks and other vital services. We accelerate out-of-band incident response, DevSecOps workflows, mission operations, and self-sovereign collaboration to bolster the focus, adaptability, and resilience of the world’s most important organizations. Our enterprise software and single-tenant SaaS platforms are built to meet the custom needs of rigorous and complex environments while offering a secure and unrivaled collaboration experience across web, desktop, and mobile with channel-based messaging, file sharing, audio calling, and screen share with integrated tooling, workflow automation, and AI assistance. No technology is perfect, and Mattermost believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Mattermost not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Mattermost, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Access All of the targets are accessible via the public internet. For local setup, self-hosted installation options are available here or here . Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . To create an account: Create an account at https://customers.mattermost.com Once in the console, navigate the URL manually to https://customers.mattermost.com/cloud and it will direct you you to the create workspace flow. User credentials created during self-signup don’t expire but invitation links sent by email expire after 48 hours and can only be used once. A Mattermost instance may be open to everyone to register or invitation-only. Roles There are multiple roles: Guest, Member, Channel Admin, Team Admin, Playbooks Admin, System Admin. There are also custom Admin roles, such as User Manager, System Manager, Viewer and Custom Groups Viewer. Please use the provided documentation and guidance of permissions-related reports. Related documentation: All the roles come with a list of default permissions but per-role permissions can be modified. About Roles Delegated Granular Administration Advanced Permissions Exclusions In scope but ineligible for bounty: *.mattermost.com Mattermost does not consider the following to be eligible vulnerabilities: Any violation of our Program Rules Brute force attacks. Example: Guessing a user's password Disclosure of server or software version numbers Server-side-request-forgery (SSRF) that requires system admin privileges, except on a cloud instance Phishing using Unicode homoglyphs or RTLO characters Issues with the SPF, DKIM or DMARC records (except from mattermost.com) CSV/Formula Injection Attacks requiring physical access to the victim's computer Adversary-in-the-middle attacks Distributed Denial of Service Content spoofing Social Engineering, including phishing Email flooding Issues related to XMLRPC Unconfirmed reports from automated vulnerability scanners Any issue in a mobile application that can only be exploited on a rooted or jailbroken device, that depends on debug access being enabled, or that depends on a vulnerability in the operating system Self-XSS without a reasonable attack scenario. In general, we accept these reports when there are a maximum of two steps required. For example, pasting a malicious payload into an input box and then clicking to preview it would be two steps Open Redirects without demonstrating additional security impact (such as stealing auth tokens) Reports exploiting the behavior of, or vulnerabilities in, outdated browsers Denial of service attacks that only affect yourself. Example: A specially crafted request that causes you not to be able to login to your account Enterprise Edition unlock attacks. Example: Modifying the source code to remove Enterprise Edition checks Reports about system users having scoped elevated permissions by default when there is a configuration option to restrict it, if needed Reports where a configuration option is available to mitigate the finding, if required Publicly-released plugins Other publicly-released plugins - Plugins that Mattermost doesn't officially support. Accepted as informational only, we accept reports about important security issues with community plugins. Mattermost will handle contacting the plugin author and will provide guidance for the community member to implement a fix. Known issues (not worth reporting): The following vulnerability types are already known and won't be fixed. These issues will be closed as Not Applicable: It's possible for unauthenticated users to determine which email addresses do and don't have accounts Information disclosure related to cross-team isolation OAuth applications don't yet support scopes and can do anything the authenticated user can do, including System Admin actions, regardless of impact. Only in scope when the action alters the delegation itself rather than acting on the user's behalf. Since we are an open source company, we have a lot of public documents that might be considered confidential at other companies. For example, our JIRA instance is public Hyperlink Injection in the emails sent to the users System Admins are allowed to perform any actions on the system EXIF metadata not being stripped from images Race conditions that lead to bypassing the limit Remote code execution (RCE) in GitHub Actions via workflow_dispatch triggers, because these can only be initiated by users with repository write access (Mattermost employees), not external attack Application behavior resulting from sysadmin-manipulated HTTP requests that create unsupported permission states (e.g. removing read message permissions while maintaining channel membership) N-Day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days have gone by e.g: N-day released on January 1st, we would consider it in-scope on January 15th Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

Additional information

Support Documentation Mattermost source code: https://github.com/mattermost/mattermost Desktop source code: https://github.com/mattermost/desktop Mobile source code: https://github.com/mattermost/mattermost-mobile Building, running, and testing Mattermost server locally: https://developers.mattermost.com/contribute/developer-setup/ Building, running, and testing Mattermost Desktop locally: https://developers.mattermost.com/contribute/more-info/desktop/developer-setup/ Building, running, and testing Mattermost Mobile locally: https://developers.mattermost.com/contribute/more-info/mobile/developer-setup/ General Mattermost documentation with explanations for all features, configuration options, roles etc: https://docs.mattermost.com/

In Scope (in scope)

Mattermost is an open-source collaboration and messaging platform designed for secure and efficient team communications. It allows team members to communicate in real-time through channels, direct messages, and group chats. In addition to messaging, Mattermost includes Playbooks, which are customizable workflows that help teams standardize and automate processes, and Calls, a feature for audio communication directly within the platform. Additionally, it integrates with various tools and services via plugins (Github, GitLab, Zoom, Jira etc.) to streamline workflows. Mattermost offers both self-hosted and cloud deployment options. The target consists of a backend, a webapp, a desktop app and mobile apps (iOS & Android). A free instance can be created by signing up at https://customers.mattermost.com/cloud/signup Otherwise, the target can be installed locally with the following ways: From source code: https://github.com/mattermost/mattermost Other installation options: https://mattermost.com/download/ Mattermost Jira Plugin - Two-way integration between Mattermost and Jira. Supports Jira to Mattermost notifications (channel subscriptions and personal notifications) and managing Jira issues in Mattermost (create issue, attaching messages to Jira issues, transition Jira issues, assign Jira issues) Source code: https://github.com/mattermost/mattermost-plugin-jira Mattermost Zoom Plugin - Allows team members to initiate a Zoom meeting with a single click. All participants in a channel can easily join the Zoom meeting and the shared link is updated when the meeting is over. Source code: https://github.com/mattermost/mattermost-plugin-zoom Mattermost GitHub Plugin - Two-way integration between Mattermost and GitLab. Offers real-time updates on commits, pull requests, issues and the ability to create GH issues from within Mattermost Source code: https://github.com/mattermost/mattermost-plugin-github Mattermost GitLab Plugin - Two-way integration between Mattermost and GitLab. Offers real-time updates and notifications on new and closed merge requests, new and closed issues, and tag creation events. Source code: https://github.com/mattermost/mattermost-plugin-gitlab Mattermost Calls Plugin - This really part of the primary target but it’s developed as a plugin. It enables voice calling and screen sharing functionality in Mattermost channels. Source code: https://github.com/mattermost/mattermost-plugin-calls Mattermost Playbooks Plugin - This is also part of the primary target but is developed as a plugin. Playbooks in Mattermost provide structure, monitoring, and automation for team-based processes. They use configurable checklists to guide teams toward specific outcomes, triggering tasks based on keywords or actions. Playbooks can include automated/manual tasks, status updates, workflow dashboards, and retrospective reviews as part of their execution and completion. Source code: https://github.com/mattermost/mattermost-plugin-playbooks Mattermost Boards plugin - A project management tool within the Mattermost platform that allows teams to organize, track, and collaborate on tasks visually, using a board-style layout similar to kanban. Source code: https://github.com/mattermost/mattermost-plugin-boards Mattermost Copilot plugin - AI-powered tool that assists users by generating insights, summaries, and automated responses Source code: https://github.com/mattermost/mattermost-plugin-ai Mattermost Microsoft Calendar Plugin - Two-way integration between Mattermost and Microsoft Outlook Calendar. Source code: https://github.com/mattermost/mattermost-plugin-mscalendar Mattermost Plugin for Microsoft Teams Meetings - Enables users to schedule, join, and manage Microsoft Teams meetings directly from the Mattermost platform Source code: https://github.com/mattermost/mattermost-plugin-msteams-meetings Mattermost MSTeams Plugin - Enables forwarding real-time chat notifications from Microsoft Teams to Mattermost. Source code: https://github.com/mattermost/mattermost-plugin-msteams Mattermost Plugin for Confluence - Integration from Confluence to Mattermost, delivering real-time updates on page and space activity directly into channels, with simple in-channel subscription management. Source code: https://github.com/mattermost/mattermost-plugin-confluence