Mattermost ANSI Escape Sequence Vulnerability in mmctl Commands

A vulnerability exists in Mattermost versions 11.2.x through 11.2.2, 10.11.x through 10.11.10, 11.4.x through 11.4.0, and 11.3.x through 11.3.1. These versions fail to properly sanitize user-controlled post content in the mmctl commands terminal output. This oversight allows attackers to manipulate administrator terminals by sending crafted messages that include ANSI and OSC escape sequences. Such manipulation can lead to screen alterations, the creation of fake prompts, and unauthorized access to the clipboard.

Impact

Exploitation of this vulnerability could result in unauthorized manipulation of administrator terminal sessions, including screen disruptions, the introduction of deceptive prompts, and interception of clipboard contents.

Remediation

Users can upgrade to Mattermost versions 11.5.0, 11.6.0, or 11.4.3 to address this vulnerability.