Mattermost SAML Redirect Vulnerability Leading to Cookie Theft

A vulnerability exists in Mattermost versions 10.10.x prior to 10.10.1, 10.5.x prior to 10.5.9, and 10.9.x prior to 10.9.4. These versions fail to properly validate the redirect_to parameter, allowing attackers to create malicious links. When a user authenticates via SAML, these links can capture and send the user's cookies to an attacker-controlled URL.

Impact

Exploitation of this vulnerability allows for the theft of user cookies, which could be used to hijack user sessions.

Remediation

Users can upgrade to Mattermost versions 10.11.010.10.2, 10.11.010.5.10, or 10.11.010.9.5 to address this vulnerability.