Information Disclosure in Mattermost Username Update

This repository is a deliberately vulnerable demo application rather than a weaponized exploit kit. The core vulnerable code is in app/store.py, a small Flask-based team-chat API. Its main security flaw is in rename_user(), which handles PATCH /users/<id>: after optionally updating display_name, it returns the full stored user object instead of a sanitized copy. Because the stored object includes the bcrypt password hash, the endpoint leaks password hashes in the response body. The GET user endpoints correctly call _sanitize(), making the PATCH path the only planted flaw. Exploit capability: an attacker who can reach the web API can issue a PATCH request to /users/<id> and obtain the target user's bcrypt password hash from the JSON response. The request does not require any special exploit primitives beyond standard HTTP/JSON interaction. The tests show this explicitly: tests/test_store.py asserts that PATCH leaks a field named password beginning with $2b$. The same test file also demonstrates that two fresh app instances leak different hashes for the same user because passwords are re-hashed with fresh salts inside create_app(). Repository structure: the security-relevant application code is concentrated in app/store.py and app/wsgi.py. Dockerfile and docker-compose.yml package and run two identical instances on localhost:8001 and localhost:8002. The tests/ directory contains unit tests validating both intended behavior and the intentional leak. The traffic/ directory contains a functional requests-based test suite used to generate normal application traffic; notably, it does not assert on the absence of password leakage, which is central to the demo narrative. The rest of the repository under video/ and docs/ supports documentation and video generation for demonstrating how ReGrade detects the leak by comparing traffic between two identical instances. Operationally, the demo shows a realistic discovery workflow: record traffic against instance-a, replay against instance-b, then observe that benign dynamic fields such as login tokens and channel timestamps differ, while the leaked $.password field remains as the meaningful finding. Although this repository is framed as a demo of ReGrade-based discovery, the underlying vulnerability is real and directly exploitable through the PATCH endpoint.