CVE-2024-37182: Mattermost Desktop App Remote Code Execution

June 14, 2024 (updated June 17, 2024)

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim’s system via custom URI schemes.

References

github.com/advisories/GHSA-hvxg-77mg-vrvp
github.com/mattermost/desktop
github.com/mattermost/desktop/commit/1c9fc719dc2b74495a05f7ebc90e92e7daa03e6d
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2024-37182

Code Behaviors & Features

Detect and mitigate CVE-2024-37182 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →