Mattermost Desktop App Denial-of-Service Vulnerability via Server-Rendered Content

A denial-of-service vulnerability has been identified in the Mattermost Desktop App, affecting versions 6.1, 6.0.1, and 5.4.13.0. The issue arises because the application fails to properly manage server-rendered content, allowing a malicious server or plugin to close an underlying application view. This is achieved by invoking 'window.close()' in the renderer context, which crashes the desktop client and disrupts the user's experience.

Impact

Exploitation of this vulnerability leads to a crash of the Mattermost Desktop client, causing a denial-of-service condition at the client level.

Remediation

Users are advised to update to the latest version of the Mattermost Desktop App. Details on the security update will be posted on the Mattermost Security Updates page.