{"id":850,"date":"2023-06-28T14:00:13","date_gmt":"2023-06-28T14:00:13","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/pronalazak-zero-day-ranjivosti-u-mattermost-platformi\/"},"modified":"2026-11-04T08:51:43","modified_gmt":"2026-11-04T08:51:43","slug":"pronalazak-zero-day-ranjivosti-u-mattermost-platformi","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/pronalazak-zero-day-ranjivosti-u-mattermost-platformi\/","title":{"rendered":"Otkrili smo Zero-day ranjivost Mattermost platforme"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>In\u017eenjer za ra\u010dunalnu sigurnost u Nacionalnom CERT-u (F. Omazi\u0107) je prilikom testiranja popularne platforme za sigurne komunikacije \"Mattermost\" otkrio ranjivost nultog dana (zero-day vulnerability).<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S obzirom na to da se radilo o lokalnoj instanci Mattermost poslu\u017eitelja, kao PoC (Proof of concept) izra\u0111ena je i zero-day exploit skripta, to jest skripta koja iskori\u0161tava prona\u0111enu ranjivost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prema pravilima odgovornog prijavljivanja ranjivosti, ranjivost je prijavljena Mattermost razvojnom timu programera i in\u017eenjera za ra\u010dunalnu sigurnost uz svu potrebnu dokumentaciju, opis ranjivosti i prilo\u017eeni exploit k\u00f4d kao PoC te potencijalni popravak.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tako\u0111er, radi odgovornog prijavljivanja sve dodatne ranjivosti, exploit k\u00f4d i gre\u0161ke vezane uz ovaj pronalazak ne\u0107e biti objavljene. <br><br><strong>Ranjivost u pitanju dobila je dodjelu CVSS ranga Medium, a radi se o ranjivosti koja dozvoljava uskra\u0107ivanje usluge (Denial of service)\u00a0pomo\u0107u jednostavne programske skripte koja \u0161alje modificirane zahtjeve poslu\u017eitelju i tako iskori\u0161tava niz ranjivosti.<\/strong><br><br>Mattermost tim javno je izrazio zahvale za doprinos razvoju Mattermost platforme:\u00a0<br>- <a href=\"https:\/\/mattermost.com\/security-vulnerability-report\/\" rel=\"noreferrer noopener\" target=\"_blank\">https:\/\/mattermost.com\/security-vulnerability-report\/<\/a><br>te<br>- <a href=\"https:\/\/mattermost.com\/security-updates\/\" rel=\"noreferrer noopener\" target=\"_blank\">https:\/\/mattermost.com\/security-updates\/<\/a> (MMSA-2023-00171)\u00a0<br><br><strong>Te je dodijeljen CVE broj kao oznaka ranjivosti:<br><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2023-2785\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2023-2785<\/a><\/strong><br><br>Reference:<br><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-2785\" rel=\"noreferrer noopener\" target=\"_blank\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-2785<\/a><br><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-2785\" rel=\"noreferrer noopener\" target=\"_blank\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-2785<\/a><br><br>CERT.hr nastavlja suradnju i kori\u0161tenje Mattermost platforme te izra\u017eava izuzetno zadovoljstvo biti od koristi projektu kao \u0161to je Mattermost sa svojim doprinosima.<\/p>","protected":false},"excerpt":{"rendered":"<p>In\u017eenjer za ra\u010dunalnu sigurnost u Nacionalnom CERT-u (F. Omazi\u0107) je prilikom testiranja popularne platforme za sigurne komunikacije &#8220;Mattermost&#8221; otkrio ranjivost nultog dana (zero-day vulnerability). S obzirom na to da se radilo o lokalnoj instanci Mattermost poslu\u017eitelja, kao PoC (Proof of concept) izra\u0111ena je i zero-day exploit skripta, to jest skripta koja iskori\u0161tava prona\u0111enu ranjivost. Prema [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1342,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-850","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=850"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/850\/revisions"}],"predecessor-version":[{"id":1346,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/850\/revisions\/1346"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1342"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=850"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=850"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}