Mattermost Confluence Plugin HTML Injection Vulnerability Allowing Cross-Site Scripting

A cross-site scripting vulnerability has been identified in the Mattermost Confluence plugin, specifically in versions prior to 1.7.0. The issue arises because the plugin fails to properly escape user-controlled display names during HTML template rendering. This flaw enables authenticated Confluence users with malicious display names to execute arbitrary JavaScript in the browsers of victims. The exploitation involves sending a crafted OAuth2 connection link that, when clicked, displays the attacker's unvalidated display name, thereby executing the embedded JavaScript.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Remediation

Users can update to Mattermost Confluence plugin version 1.7.0 or later to address this vulnerability.