Lucene search

HackeroneCVELIST:CVE-2022-44567

HistoryDec 23, 2022 - 12:00 a.m.

CVE-2022-44567

2022-12-2300:00:00

CWE-78

hackerone

www.cve.org

rocket chat desktop

command injection

remote code execution

xss attack

cve-2022-44567

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.8%

JSON

A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal(), which may lead to remote code execution (internalVideoChatWindow.ts#L17). To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used (internalVideoChatWindow.ts#L14). The vulnerability may be exploited by an XSS attack because the function openInternalVideoChatWindow is exposed in the Rocket.Chat-Desktop-API.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Rocket.chat - Electron Desktop",
    "versions": [
      {
        "version": "fixed in => v3.8.14",
        "status": "affected"
      }
    ]
  }
]

References

hackerone.com/reports/1781102