Rocket.Chat - Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. id: CVE-2024-39713 info: name: Rocket.Chat - Server-Side Request Forgery SSRF author: iamnoooob,rootxharsh,pdresearch severity: high description: | A Server-Side Request Forgery SSRF affects...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi Token Leak & Password Reset An automated exploit script for Rocket.Chat and Meteor-based applications that leverages a NoSQL Injection via the $where clause to leak password reset tokens through server-side exceptions. Once the token is leaked, the script performs an...

CVE-2024-39713

CVE-2024-39713: Rocket.Chat SSRF PoC Descripción Una falsificación de solicitudes del lado del servidor SSRF afecta al endpoint de webhook de Twilio de Rocket.Chat antes de la versión 6.10.1. Enlaces: https://nvd.nist.gov/vuln/detail/CVE-2024-39713 https://hackerone.com/reports/1886954 Uso...

Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911

Rocket.Chat Automated Unauthenticated Account Takeover to RCE CVE-2021-22911 Full unauthenticated RCE proof of concept for Rocket.Chat 3.12.1 CVE-2021-22911 The original PoC created by Enox. Currently this only works for accounts without 2FA. I will be adding 2FA bypasses shortly Created by...

CVE-2021-22911

Updated exploit for CVE-2021-22911 Rocket.Chat 3.12.1 - NoSQL Injection to RCE Unauthenticated original credits to : https://www.exploit-db.com/exploits/50108 Setup Create python virtual environment and install deps root@kitploit: $ python -m venv venv $ source venv/bin/activate $ pip install...

Rocket.Chat <=3.13 - NoSQL Injection

Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected...

Rocket-Chat-3.12.1-PoC-CVE-2021-22911-

Rocket-Chat-3.12.1-PoC-CVE-2021-22911- 1. Go login page 2. Register new account, set password as P@$$w0rd!1234 3. Run script -u = Low priv user email No 2fa -a = Administrator email -t = URL Eg: http://rocketchat.local python3 rocketchat.py -u [email protected] -a [email protected] -t...

Rocket.Chat

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

CVE-2021-22911-RocketChat

CVE-2021-22911 — Rocket.Chat 3.12.1 RCE Improvisado Descripción Explota una vulnerabilidad de inyección NoSQL sin autenticación en Rocket.Chat 3.12.1 para filtrar el secreto TOTP del administrador y el token de restablecimiento de contraseña, tomar el control de la cuenta de administrador y logra...

CVE-2021-22911

CVE-2021-22911 Inyección NoSQL ciega sin autenticación previa que conduce a ejecución remota de código en Rocket Chat 3.12.1 El método getPasswordPolicy es vulnerable a ataques de inyección NoSQL y no requiere autenticación/autorización. Puede utilizarse para tomar el control de cuentas filtrando...

CVE-2026-29198-POC

CVE-2026-29198-POC Rocket.Chat OAuth2 NoSQL Injection , in Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9 setup install: pip3 install -r requirement.txt Exploit: python3 poccve202629198.py --url domain --escalate -v...

exploit-cve

CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Links: https://nvd.nist.gov/vuln/detail/CVE-2024-39713 https://hackerone.com/reports/1886954 Usage root@kitploit: pip install -r requirements.tx...

rocketcat-cve-2021-22911-exploit

Rocket.Chat CVE-2021-22911 Exploit ⚠️ DISCLAIMER - EDUCATIONAL USE ONLY This exploit is for authorized penetration testing and educational purposes only. Unauthorized access to computer systems is illegal. The author is not responsible for any misuse. 📋 Overview CVE-2021-22911 is a critical...

CVE-2021-22911

CVE-2021-22911 If you have already registered a user this will only reset the admin password, and not both. Making the exploit run much faster. python3 exploit.py -u test -a [email protected] -t http://chat.rocket.thm -i 10.10.4.24 -p 80...

CVE-2021-22911

CVE-2021-22911 Inyección NoSQL ciega sin autenticación previa que conduce a la ejecución remota de código en Rocket Chat 3.12.1 El método getPasswordPolicy es vulnerable a ataques de inyección NoSQL y no requiere autenticación/autorización. Puede usarse para tomar el control de cuentas al filtrar...

CVE-2026-75575

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-75575 Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-75575 Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

CVE-2026-75575

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, allowing an unauthenticated caller to invoke it via DDP or the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail. Because no DDPRateLimiter rule is registered, an attacker can send an unbounded v...

EUVD-2026-65218

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...